Vulnerabilities

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary files on the server and trigger server-side HTTP requests (SSRF), a file/path handling flaw tracked as CWE-73. An attacker submits crafted markdown image syntax in checkout acceptance notes; the syntax survives HTML escaping, is expanded by the CommonMark parser, and the resulting image reference is fetched by laravel-mail-auto-embed using file_get_contents or curl, so the target can be a local file or an attacker-chosen URL. A low-privileged authenticated user gains arbitrary file read (e.g., exfiltrating the .env file, which contains the Laravel APP_KEY and other secrets) and can probe internal services or reach external URLs via the server-side request. All Snipe-IT deployments running any version prior to 8.7.0, where authenticated users can submit notes on checkout acceptance, are affected; the flaw is network-reachable with low privileges required, rated 8.4 High under CVSS 4.0. No public proof-of-concept or confirmed in-the-wild exploitation is currently known, and the issue is not in the CISA KEV catalog.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes sanitization of markdown image syntax in note fields. As interim mitigations, restrict or strip markdown image syntax from acceptance notes, limit outbound HTTP connectivity from the Snipe-IT server to block SSRF callbacks, and verify that the web server user cannot read more configuration than necessary; if compromise is suspected, rotate the APP_KEY and any other secrets stored in .env.

Snipe-IT versions before 8.7.0 contain a CSS injection flaw (CWE-79) in the Custom CSS field, where sanitization HTML-encodes greater-than and double-quote characters but then reverses that encoding, allowing crafted CSS containing those characters to pass through unescaped. A superuser can plant a payload built from @import and url() references combined with attribute-selector rules; when other superusers load the application, the injected CSS silently sends their CSRF tokens to attacker-controlled servers. With a stolen CSRF token, the attacker can perform cross-site request forgery actions against the victim's session, achieving takeover of other superuser accounts. Any organization running Snipe-IT prior to 8.7.0 is affected, with risk concentrated in instances that have multiple superusers, one of which is malicious or compromised. Despite a critical 9.3 CVSS 4.0 score, exploitation is currently unknown: there is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade to Snipe-IT 8.7.0 or later, which fixes the Custom CSS sanitization. Until then, audit the Custom CSS field for unexpected @import, url(), or attribute-selector payloads, restrict superuser accounts to trusted administrators, and consider limiting outbound network access from the Snipe-IT server to block token exfiltration. Deployments with only a single superuser have little practical exposure unless that account itself is compromised.

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference, CWE-639) in the asset checkout-request cancellation endpoint, where the cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check. An authenticated, low-privileged user can submit a cancellation request with a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending asset checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the organization's asset-request workflow. Any Snipe-IT deployment running a version earlier than 8.6.0 is affected, with risk limited to instances that grant accounts to low-privileged users. No in-the-wild exploitation is known; a public proof-of-concept reference is available via Tenable Research (TRA-2026-54), EPSS is low at 0.3% (20th percentile), and the flaw is not in CISA KEV, with a medium CVSS 4.0 score of 5.3.

Do: Upgrade to Snipe-IT 8.6.0 or later, which restores the server-side authorization check on the checkout-request cancellation endpoint. Because exploitation requires a low-privileged authenticated account, prioritize patching instances exposed to untrusted or shared users; details and the PoC are documented in Tenable Research advisory TRA-2026-54.

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.

Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example `assets.view`, `assets.create`, `reports.view`, import, etc. The issue is patched in version 8.6.0.