CVE Vulnerability Catalog

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/personal-access-tokens*) with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints (/account/api and /api/v1/account/personal-access-tokens). Any user with a valid web session and the corresponding CSRF token can POST to /oauth/personal-access-tokens and mint a long-lived bearer token for their own account, even when an administrator has denied the self.api permission. The issued token is still subject to existing per-endpoint authorization policies, so this is not a privilege escalation; it defeats the administrative control intended to block API/scripted access at the user's own permission level. Fixed in 8.7.0 (commit 3f74b8c), which registers overriding routes wrapped in the can:self.api middleware.

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refactored.

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages(). When a storage write silently fails, the application still deletes the previous image and persists a reference to a new filename that was never written. A mirror problem exists in deleteExistingImage(), where a failed Storage::delete() still nulls the image field, orphaning the file on disk. The condition is not directly attacker-controlled — it occurs when an authenticated user submits an image while the storage backend transiently fails (e.g., S3 network error, filesystem permission issue, quota exhaustion). The result is unrecoverable loss of the prior image and a durable database-disk inconsistency. All models routed through ImageUploadRequest::handleImages are affected (assets, asset models, users, companies, manufacturers, locations, categories, suppliers, departments, and others).

Snipe-IT before version 8.7.0 wipes the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading corrupted or invalid zip files trigger permanent data loss with no recovery path or rollback mechanism.

In Snipe-IT up to and including version 8.6.3, the report acceptance endpoints are not correctly scoped when Full Multiple Company Support (FMCS) is enabled. An authenticated user with reports.view permission can send acceptance-reminder emails and permanently delete acceptance records from other companies due to missing scope checks.

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots to invoke protected methods and escalate privileges.

In Snipe-IT master-branch builds after 8.6.3 (not in any tagged release), the FMCS location-scoping mismatch report export does not apply CSV formula escaping, unlike other exports. An authenticated user can place a spreadsheet formula in text fields that gets executed when the CSV is opened in spreadsheet applications.

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names.

Snipe-IT through 8.6.3 does not neutralize formula elements in the 'unaccepted assets' acceptance report CSV export. The report is built manually and does not apply League\Csv\EscapeFormula. An authenticated low-privilege user can place a formula in text fields that gets executed when the CSV is opened in spreadsheet applications.

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to cause denial of service. Attackers can send modal form response packets with massive JSON arrays to exhaust server memory and CPU resources.

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket messages to spam animation events to other clients and waste server CPU and memory resources.

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to flood warning messages by injecting numerous junk properties into the clientData JWT. Attackers can craft malicious login packets with excessive unknown properties to waste server CPU time and degrade performance.

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player objects and amplifying memory consumption and network traffic.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Sanitization of Custom Special Characters vulnerability. An unauthenticated attacker with remote access could exploit this to perform script injection.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Neutralization of Escape, Meta, or Control Sequences vulnerability. An unauthenticated attacker with remote access could exploit this to launch phishing attacks.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Encoding or Escaping of Output vulnerability. An unauthenticated attacker with remote access could exploit this to launch phishing attacks.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could exploit this to cause information exposure.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could exploit this to gain unauthorized access.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit this to bypass protection mechanisms.