Snipe-IT CVE-2026-86770

Exploitation requires that Snipe-IT is configured to use at least one federated authentication path - SAML, LDAP, or OAuth. Instances relying exclusively on Snipe-IT's local authentication are not affected. The attacker must have the ability to register or modify an account at the connected identity provider to set an arbitrary username. The underlying database must use MySQL or MariaDB with the utf8mb4_unicode_ci collation (the MySQL/MariaDB default), which is the mechanism enabling the variant-to-victim match. The CVSS PR:L metric confirms that some level of IdP access is required; unauthenticated network access alone is insufficient. Exploitation is limited to Snipe-IT versions 8.6.3 through 8.6.x.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N yields a base score of 8.6, reflecting high confidentiality and integrity impact constrained by the PR:L requirement that the attacker control an account at the federated identity provider. The attack complexity is low once the IdP account is established - the collation bypass is deterministic and requires no race condition or special timing. Real-world risk is significant for organizations that have enabled SAML, LDAP, or OAuth in Snipe-IT: even a mid-sized municipal IT team in malbork running Snipe-IT for asset tracking should treat this as urgent, since a compromised account exposes full asset inventory, user assignments, and potentially sensitive license keys. No CISA KEV listing and no public exploit code exist at time of analysis, but the GHSA advisory is technically detailed enough for straightforward replication. Instances using only local (non-federated) authentication are not affected, which meaningfully narrows the exploitable population.

An attacker with the ability to register accounts at the organization's federated IdP creates a new account named 'SYSADMIN' (or 'sÿsadmin' using an accented variant) targeting an existing Snipe-IT user 'sysadmin'. When the attacker authenticates via SAML, Snipe-IT's database query resolves the variant to the victim's record under the utf8mb4_unicode_ci collation, establishing a fully authenticated session as the victim. No public exploit code exists, but the GHSA advisory provides sufficient technical detail for replication.