Threat Intelligence Database

Snipe-IT versions prior to 8.6.0 contain an authorization vulnerability allowing users with the users.edit permission to escalate privileges by granting themselves additional permissions except admin and superuser. This issue is fixed in version 8.6.0.

Multiple vulnerabilities have been identified in Snipe-IT, an open-source web-based asset management software used by organizations to track hardware and software. These vulnerabilities affect versions prior to 8.5.1. No CVSS score is available for these issues. There are no known exploits in the wild at this time. The vendor has not provided explicit patch or remediation information in the available data.

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

Snipe-IT versions prior to 8.4.1 contain an open redirect vulnerability (CWE-601) that allows attackers to redirect users to malicious websites by exploiting an unvalidated HTTP Referer header stored in a session variable. This issue is resolved in version 8.4.1. The vulnerability has a medium severity with a CVSS score of 5.9.

CVE-2026-44832 is a privilege escalation vulnerability in grokability's Snipe-IT IT asset/license management system versions prior to 8.4.1. An authenticated user with only the users.edit permission can escalate their privileges to admin by sending a specially crafted PATCH request to the user API endpoint. The API controller improperly preserves permissions by only stripping the superuser key but allowing the admin permission to be set, enabling unauthorized privilege escalation. This vulnerability is fixed in version 8.4.1.

CVE-2026-44831 is a medium severity cross-site scripting (XSS) vulnerability affecting Snipe-IT versions prior to 8.4.1. The issue arises from improper neutralization of input in the notes column visible to users with component view access, allowing injection of malicious scripts. This vulnerability has been fixed in version 8.4.1. The CVSS score is 4.8, reflecting a low attack complexity and limited privileges required, but requiring user interaction. No known exploits are reported in the wild.