Which versions of Snipe-IT are affected by CVE-2026-86770?

Snipe-IT asset management systems prior to version 8.7.0 can be compromised through account takeover attacks by any user with identity provider credentials, enabling attackers to impersonate…. A patch is available.

How to fix or mitigate CVE-2026-86770?

Within 24 hours, identify all Snipe-IT deployments running versions prior to 8.7.0 and assess which identity provider platforms support new user registration in your federated configurations. Within 7 days, upgrade all affected Snipe-IT instances to version 8.7.0 or later and test SAML, LDAP, and OAuth authentication workflows to confirm functionality post-deployment. Within 30 days, conduct a forensic account audit to identify user creation timestamps and associated identity provider usernames from the pre-patch period, implement identity provider access controls to restrict new account registration rights where feasible, and review administrative account activity logs for unauthorized access indicators.

Snipe-IT CVE-2026-86770

Q: What is the CVSS score of CVE-2026-86770?

CVE-2026-86770 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-74947 HIGH

Improper Handling of Case Sensitivity (CWE-178)

2026-09-09 VulnCheck

GHSA-vp3x-c2h8-v6w8

Authentication Bypass Snipe It Grokability

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

PR:L because the attacker must control an IdP account; no scope change as impact is confined to the Snipe-IT application itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 09, 2026 - 15:21 vuln.today

Analysis Generated

Sep 09, 2026 - 14:40 vuln.today

Patch available

Sep 09, 2026 - 14:19 EUVD

CVE Published

Sep 09, 2026 - 13:32 cve.org

HIGH 8.6

DescriptionCVE.org

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

AnalysisAI

Account takeover in Snipe-IT before 8.7.0 allows low-privileged identity-provider users to hijack arbitrary Snipe-IT accounts by registering IdP usernames that are case or Unicode accent variants of existing victim usernames. The vulnerability exploits MySQL's default utf8mb4_unicode_ci collation, which conflates these variants during database lookups, enabling an attacker to be matched to a different user's record across all federated authentication paths - SAML, LDAP, and OAuth. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that Snipe-IT is configured to use at least one federated authentication path - SAML, LDAP, or OAuth. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N yields a base score of 8.6, reflecting high confidentiality and integrity impact constrained by the PR:L requirement that the attacker control an account at the federated identity provider. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Snipe-IT to version 8.7.0 or later, the vendor-confirmed patched release documented in GHSA-w3vv-5wxh-xg4h. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Snipe-IT deployments running versions prior to 8.7.0 and assess which identity provider platforms support new user registration in your federated configurations. …

Threat intelligence, references, and detailed analysis are available after sign-in.