Grokability

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-48507	Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding only the granular `users.edit` permission to disable administrator and superuser accounts through the bulk-edit endpoint, effectively locking all admins out of the instance. By toggling the `activated` and `ldap_import` flags on admin targets, a low-privileged actor denies admins both interactive login and password-reset recovery. No public exploit identified at time of analysis, but the upstream fix and detailed advisory disclose the exact attack surface.	HIGH	7.1	0.0%	56	PoC
CVE-2026-86738	Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.	CRITICAL	9.3	0.3%	46
CVE-2026-85617	Authorization bypass in Snipe-IT's bulk delete endpoint (all versions before 8.6.3) allows restricted authenticated users to soft-delete user accounts outside their authorized management scope by supplying arbitrary user IDs in a bulk delete request. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the endpoint accepts attacker-controlled user IDs without validating them against the requesting user's permitted scope. No public exploit code and no CISA KEV listing have been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-86762	Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to the API middleware group, allowing deactivated accounts to retain full REST API access through their existing Laravel Passport personal access tokens. Any deactivated user whose token has not been explicitly revoked can continue reading and writing assets, users, and licenses at their prior permission level, bypassing the offboarding control that correctly blocks web sessions. The most critical escalation path lets a deactivated account previously holding users.edit permission PATCH its own activation flag via /api/v1/users/{id} to permanently re-enable itself. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 8.7.0.	HIGH	8.6	0.3%	43
CVE-2026-86770	Account takeover in Snipe-IT before 8.7.0 allows low-privileged identity-provider users to hijack arbitrary Snipe-IT accounts by registering IdP usernames that are case or Unicode accent variants of existing victim usernames. The vulnerability exploits MySQL's default utf8mb4_unicode_ci collation, which conflates these variants during database lookups, enabling an attacker to be matched to a different user's record across all federated authentication paths - SAML, LDAP, and OAuth. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.	HIGH	8.6	0.3%	43
CVE-2026-86733	Remote code execution in Snipe-IT before 8.7.0 allows authenticated superadministrators to execute arbitrary OS commands on the server by uploading a crafted backup archive and triggering a restore. The vulnerability stems from Snipe-IT piping SQL backup content directly into the MySQL/MariaDB command-line client without the --binary-mode flag, causing the client to interpret backslash escape sequences (e.g., \!) as local shell commands rather than SQL. Successful exploitation exposes sensitive application secrets including database credentials and APP_KEY, and permits modification of any file writable by the web application process. No public exploit or KEV listing has been identified at time of analysis.	HIGH	8.6	0.3%	43
CVE-2026-86754	Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to register OAuth clients with attacker-controlled redirect URIs by directly accessing Laravel Passport's client management routes, which are not properly gated to administrative users. An attacker with any valid account can then social-engineer an administrator into approving a crafted OAuth consent screen, capturing the resulting authorization code and exchanging it for a bearer token inheriting full admin API permissions. The compounding risk is a token lifetime of up to 40 years, meaning harvested tokens remain valid far beyond typical credential rotation cycles without explicit revocation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.	HIGH	8.5	0.2%	42
CVE-2026-85616	Cross-company authorization bypass in Snipe-IT before 8.6.2 allows authenticated users with the reports.view permission to manipulate checkout-acceptance records belonging to other companies in multi-tenant deployments. By enumerating sequential acceptance IDs and exploiting a null check defect on the legacy users.company_id column, an attacker can soft-delete acceptance records or trigger unsolicited reminder emails across company boundaries. Vendor-released patch v8.6.2 is available; no public exploit or active exploitation has been identified at time of analysis.	HIGH	8.4	0.3%	42
CVE-2026-86751	Server-side request forgery and arbitrary file read in Snipe-IT before 8.7.0 allow any authenticated user to exfiltrate sensitive server files - including the Laravel `.env` file containing `APP_KEY` - by injecting markdown image syntax into checkout acceptance note fields. The injected syntax survives HTML escaping, is expanded by the CommonMark parser, and subsequently resolved by the laravel-mail-auto-embed library via `file_get_contents()` (local paths) or `curl` (remote URLs) when email notifications are generated. Vendor-released patch is available in version 8.7.0; no public exploit has been identified at time of analysis, but compromise of `APP_KEY` can facilitate escalation to remote code execution via Laravel cookie/session decryption.	HIGH	8.4	0.2%	42
CVE-2026-86741	Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.	HIGH	8.4	0.2%	42
CVE-2026-86750	Tenant boundary violation in Snipe-IT ≤ 8.6.3 allows an authenticated low-privileged API user to create or relocate user accounts into company scopes outside their authorization. The REST API handlers Api\UsersController::store() and ::update() commit the user record to the database before filtering submitted company_id and company_ids[] values against the actor's permitted companies via Company::getIdsForCurrentUser(), making the post-hoc authorization check unable to undo the database write. On instances with null_company_is_floater=1 configured, the resulting misaligned account is persisted as a cross-company 'floater,' gaining visibility across all tenant boundaries. No public exploit has been identified at time of analysis, but the exploitation mechanics are described in sufficient detail in the GHSA advisory to reproduce without additional tooling.	HIGH	8.3	0.2%	42
CVE-2026-86771	Server-side request forgery in Snipe-IT before 8.7.0 allows an authenticated low-privileged attacker to pivot the application server against internal network resources, cloud metadata endpoints, or arbitrary external targets. The vulnerability stems from TCPDF's writeHTML() processing unsanitized img tag injection through the employee_num field in the asset acceptance PDF generator. Exploitation is deferred until a victim user signs an asset acceptance form, at which point the server makes an outbound HTTP(S) request to the attacker-controlled URL embedded in the rendered PDF. A proof-of-concept exists per SSVC data; no active exploitation has been confirmed in CISA KEV.	HIGH	8.3	0.2%	42
CVE-2026-55516	Authorization bypass in Snipe-IT allows authenticated low-privileged users to move maintenance records to assets outside their company scope by manipulating the asset_id field during PATCH/PUT requests on /api/v1/maintenances/{id}. The vulnerability affects versions before 8.6.2 and is fixed in that release. EPSS remains low (0.22%) with no known active exploitation or public proof-of-concept.	HIGH	7.7	0.2%	39
CVE-2026-55643	Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.	HIGH	7.6	0.3%	38
CVE-2026-86746	Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.	HIGH	7.4	0.3%	37

CVE-2026-48507

Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding only the granular `users.edit` permission to disable administrator and superuser accounts through the bulk-edit endpoint, effectively locking all admins out of the instance. By toggling the `activated` and `ldap_import` flags on admin targets, a low-privileged actor denies admins both interactive login and password-reset recovery. No public exploit identified at time of analysis, but the upstream fix and detailed advisory disclose the exact attack surface.

HIGH

7.1

0.0%

56

PoC

CVE-2026-86738

Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.

CRITICAL

9.3

0.3%

46

CVE-2026-85617

Authorization bypass in Snipe-IT's bulk delete endpoint (all versions before 8.6.3) allows restricted authenticated users to soft-delete user accounts outside their authorized management scope by supplying arbitrary user IDs in a bulk delete request. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the endpoint accepts attacker-controlled user IDs without validating them against the requesting user's permitted scope. No public exploit code and no CISA KEV listing have been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-86762

Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to the API middleware group, allowing deactivated accounts to retain full REST API access through their existing Laravel Passport personal access tokens. Any deactivated user whose token has not been explicitly revoked can continue reading and writing assets, users, and licenses at their prior permission level, bypassing the offboarding control that correctly blocks web sessions. The most critical escalation path lets a deactivated account previously holding users.edit permission PATCH its own activation flag via /api/v1/users/{id} to permanently re-enable itself. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 8.7.0.

HIGH

8.6

0.3%

43

CVE-2026-86770

Account takeover in Snipe-IT before 8.7.0 allows low-privileged identity-provider users to hijack arbitrary Snipe-IT accounts by registering IdP usernames that are case or Unicode accent variants of existing victim usernames. The vulnerability exploits MySQL's default utf8mb4_unicode_ci collation, which conflates these variants during database lookups, enabling an attacker to be matched to a different user's record across all federated authentication paths - SAML, LDAP, and OAuth. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.

HIGH

8.6

0.3%

43

CVE-2026-86733

Remote code execution in Snipe-IT before 8.7.0 allows authenticated superadministrators to execute arbitrary OS commands on the server by uploading a crafted backup archive and triggering a restore. The vulnerability stems from Snipe-IT piping SQL backup content directly into the MySQL/MariaDB command-line client without the --binary-mode flag, causing the client to interpret backslash escape sequences (e.g., \!) as local shell commands rather than SQL. Successful exploitation exposes sensitive application secrets including database credentials and APP_KEY, and permits modification of any file writable by the web application process. No public exploit or KEV listing has been identified at time of analysis.

HIGH

8.6

0.3%

43

CVE-2026-86754

Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to register OAuth clients with attacker-controlled redirect URIs by directly accessing Laravel Passport's client management routes, which are not properly gated to administrative users. An attacker with any valid account can then social-engineer an administrator into approving a crafted OAuth consent screen, capturing the resulting authorization code and exchanging it for a bearer token inheriting full admin API permissions. The compounding risk is a token lifetime of up to 40 years, meaning harvested tokens remain valid far beyond typical credential rotation cycles without explicit revocation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

HIGH

8.5

0.2%

42

CVE-2026-85616

Cross-company authorization bypass in Snipe-IT before 8.6.2 allows authenticated users with the reports.view permission to manipulate checkout-acceptance records belonging to other companies in multi-tenant deployments. By enumerating sequential acceptance IDs and exploiting a null check defect on the legacy users.company_id column, an attacker can soft-delete acceptance records or trigger unsolicited reminder emails across company boundaries. Vendor-released patch v8.6.2 is available; no public exploit or active exploitation has been identified at time of analysis.

HIGH

8.4

0.3%

42

CVE-2026-86751

Server-side request forgery and arbitrary file read in Snipe-IT before 8.7.0 allow any authenticated user to exfiltrate sensitive server files - including the Laravel `.env` file containing `APP_KEY` - by injecting markdown image syntax into checkout acceptance note fields. The injected syntax survives HTML escaping, is expanded by the CommonMark parser, and subsequently resolved by the laravel-mail-auto-embed library via `file_get_contents()` (local paths) or `curl` (remote URLs) when email notifications are generated. Vendor-released patch is available in version 8.7.0; no public exploit has been identified at time of analysis, but compromise of `APP_KEY` can facilitate escalation to remote code execution via Laravel cookie/session decryption.

HIGH

8.4

0.2%

42

CVE-2026-86741

Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.

HIGH

8.4

0.2%

42

CVE-2026-86750

Tenant boundary violation in Snipe-IT ≤ 8.6.3 allows an authenticated low-privileged API user to create or relocate user accounts into company scopes outside their authorization. The REST API handlers Api\UsersController::store() and ::update() commit the user record to the database before filtering submitted company_id and company_ids[] values against the actor's permitted companies via Company::getIdsForCurrentUser(), making the post-hoc authorization check unable to undo the database write. On instances with null_company_is_floater=1 configured, the resulting misaligned account is persisted as a cross-company 'floater,' gaining visibility across all tenant boundaries. No public exploit has been identified at time of analysis, but the exploitation mechanics are described in sufficient detail in the GHSA advisory to reproduce without additional tooling.

HIGH

8.3

0.2%

42

CVE-2026-86771

Server-side request forgery in Snipe-IT before 8.7.0 allows an authenticated low-privileged attacker to pivot the application server against internal network resources, cloud metadata endpoints, or arbitrary external targets. The vulnerability stems from TCPDF's writeHTML() processing unsanitized img tag injection through the employee_num field in the asset acceptance PDF generator. Exploitation is deferred until a victim user signs an asset acceptance form, at which point the server makes an outbound HTTP(S) request to the attacker-controlled URL embedded in the rendered PDF. A proof-of-concept exists per SSVC data; no active exploitation has been confirmed in CISA KEV.

HIGH

8.3

0.2%

42

CVE-2026-55516

Authorization bypass in Snipe-IT allows authenticated low-privileged users to move maintenance records to assets outside their company scope by manipulating the asset_id field during PATCH/PUT requests on /api/v1/maintenances/{id}. The vulnerability affects versions before 8.6.2 and is fixed in that release. EPSS remains low (0.22%) with no known active exploitation or public proof-of-concept.

HIGH

7.7

0.2%

39

CVE-2026-55643

Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.

HIGH

7.6

0.3%

38

CVE-2026-86746

Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to bypass authorization controls by replaying signed Livewire component snapshots directly against the /livewire/update endpoint. Because authorization is enforced only at the HTTP route layer and not within Livewire component lifecycle methods, a low-privilege session holder can invoke protected admin operations including creating OAuth clients, minting personal access tokens, and reading sensitive administrative data. No active exploitation has been confirmed (no CISA KEV listing), but the vendor-confirmed fix is available in version 8.7.0.

HIGH

7.4

0.3%

37

Severity Breakdown

Monthly CVE Trend

Affected Products (3)

Top Risky CVEs