What is the CVSS score of CVE-2026-37709?

CVE-2026-37709 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Snipe-IT are affected by CVE-2026-37709?

Snipe-IT versions 8.4.0 and earlier contain a critical remote code execution vulnerability in the file upload API that allows unauthenticated attackers to execute arbitrary code by bypassing…. A patch is available.

How to fix or mitigate CVE-2026-37709?

Within 24 hours: Immediately restrict network access to Snipe-IT API endpoints (specifically UploadedFilesController) using firewall or WAF rules to block external file uploads. Within 7 days: Upgrade to Snipe-IT version containing commit 676a9958 or later (released March 10, 2026 or newer); verify the specific patched version via the vendor's release notes. Within 30 days: Conduct forensic review of upload logs and file integrity checks to detect unauthorized file uploads or code execution; review and strengthen API authentication and authorization policies across all endpoints.

Snipe-IT CVE-2026-37709

EUVD-2026-28401 CRITICAL

Improper Access Control (CWE-284)

2026-05-07 mitre

GHSA-xg82-2hrv-hf64

Authentication Bypass PHP RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 07, 2026 - 20:30 vuln.today

Analysis Generated

May 07, 2026 - 20:30 vuln.today

CVSS changed

May 07, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

May 07, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component

AnalysisAI

Remote unauthenticated attackers can execute arbitrary code in Snipe-IT versions 8.4.0 and earlier by uploading malicious files through the API's UploadedFilesController component. The vulnerability stems from an authorization bypass where file upload endpoints required only 'view' permission instead of 'update' permission, allowing attackers to upload and execute code without proper authentication. Fixed in commit 676a9958 (March 10, 2026). EPSS data not available. No CISA KEV listing identified at time of analysis. Public exploit code (POC) status unknown, though GitHub security advisory GHSA-xg82-2hrv-hf64 confirms the flaw.

Technical ContextAI

Snipe-IT is an open-source IT asset management system written in PHP using the Laravel framework. This vulnerability resides in the UploadedFilesController.php API controller, which handles file upload operations. The root cause (CWE-284: Improper Access Control) involves a critical authorization logic error where the store() method checked 'view' permission instead of 'update' permission before accepting file uploads. In Laravel's authorization framework, 'view' permissions are typically granted to read-only users, while 'update' permissions enforce write access controls. The one-line fix changes the authorization gate from authorize('view', $object) to authorize('update', $object), properly enforcing write-level permissions for upload operations. Combined with the CVSS vector showing no authentication required (PR:N), this suggests the endpoint may have been exposed to unauthenticated requests or granted overly permissive default view access, enabling unauthorized file uploads that could contain executable PHP code processed by the application.

RemediationAI

Upgrade to the latest Snipe-IT version incorporating commit 676a9958 (March 10, 2026) or later. Organizations can verify the fix by checking that app/Http/Controllers/Api/UploadedFilesController.php line 96 contains 'authorize('update', $object)' instead of 'authorize('view', $object)'. Reference the vendor security advisory at https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64 for official patch guidance. If immediate patching is not possible, implement compensating controls: restrict network access to the Snipe-IT API endpoints to trusted IP ranges only using firewall rules or reverse proxy ACLs (trade-off: breaks legitimate remote API access); disable file upload functionality entirely by removing write permissions on upload directories (trade-off: breaks asset attachment features); or implement Web Application Firewall rules to block file uploads to /api/.../uploaded-files endpoints pending patch deployment (trade-off: requires WAF capability and careful tuning to avoid false positives).