CVE-2026-48507

Snipe-IT prior to 8.6.2 has a stored XSS vulnerability in manufacturer or supplier names. A crafted name can execute JavaScript when an authenticated user views the detail page, potentially exposing data or actions available to that session.

Snipe-IT prior to 8.6.3 allows any activated account to read maintenance records for assets in the same company without asset or maintenance permission. The show() method lacks authorization, disclosing asset tags, suppliers, purchase costs, notes, and dates.

Snipe-IT prior to 8.6.3 has a vulnerability that allows a restricted user to obtain another user's randomized EULA filename and download the signed file. The /stored-eula-file/{filename} and /account/stored-eula-file/{filename} routes do not consistently enforce ownership and target-user authorization.

Snipe-IT prior to 8.6.3 has a vulnerability that allows a company-scoped user in FMCS floater mode to access users whose company_id is null. Broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess, which can expose personal data and assigned licenses, and allow modification of profiles and soft-deletion of users.

Snipe-IT prior to 8.4.1 allows an authenticated user with generic asset edit permission to delete files attached to assets outside their ownership or company. The destroy() methods authorize against the object class instead of the instance, creating an insecure direct object reference.

Snipe-IT prior to 8.6.0 allows an authenticated user with users.create permission to assign admin permission when creating a user. The store() method strips superuser but not admin permission, allowing the created account to gain administrative privileges.

Snipe-IT prior to 8.4.1 allows a non-superadmin to submit company_id directly in the update() method of BulkAssetsController, bypassing Company::getIdForCurrentUser(). This allows assets to be moved across company boundaries, breaking multi-tenant isolation.

Snipe-IT prior to 8.5.0 allows a user who can edit other users to reset a superadmin's two-factor authentication. The postTwoFactorReset() endpoint authorizes update access but does not enforce canEditAuthFields before clearing two_factor_secret and two_factor_enrolled.

Snipe-IT prior to 8.6.1 allows a user with import permission to overwrite a non-admin user's email via CSV update mode and then request a password reset to take over the account. UserImporter strips unauthorized fields, but ItemImporter restores them from the raw CSV row, and the import path does not require users.edit.

Snipe-IT prior to 8.6.1 has a vulnerability in POST /two-factor with no rate limiting, lockout, or attempt counter, allowing unlimited TOTP guesses. It also allows disabling 2FA without OTP reverification in certain modes.