Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6926 vulnerabilities
CVE-2026-87930 (GCVE-0-2026-87930)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:45 – Updated: 2026-09-09 17:24 X_Open Source Unsupported When Assigned
VLAI
EPSS
VEX
Title
MaxSite CMS through 109.6 PHP Object Injection via ci_session
Summary
MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 17:22 UTC
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/maxsite/cms | product |
| https://github.com/EviL0rd/maxsite-cve6/blob/main… | exploittechnical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://github.com/EviL0rd/maxsite-cve4/blob/main… | technical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://www.vulncheck.com/advisories/maxsite-cms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MaxSite | MaxSite CMS |
Affected:
0.78 , ≤ 109.6
(custom)
cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87930",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T17:22:33.214701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T17:24:57.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/maxsite/cms",
"product": "MaxSite CMS",
"repo": "https://github.com/maxsite/cms",
"vendor": "MaxSite",
"versions": [
{
"lessThanOrEqual": "109.6",
"status": "affected",
"version": "0.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "109.6",
"versionStartIncluding": "0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EVIL0RD"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:45:00.798Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/maxsite/cms"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/EviL0rd/maxsite-cve6/blob/main/2026.09.08-maxsite-cms-unsafe-unserialize-object-injection.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L670-L680"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/system/libraries/Session.php#L740-L742"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/EviL0rd/maxsite-cve4/blob/main/2026.09.08-maxsite-cms-hardcoded-session-key-auth-bypass.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/config/config.php#L230-L254"
},
{
"name": "VulnCheck Advisory: MaxSite CMS through 109.6 PHP Object Injection via ci_session",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maxsite-cms-through-109.6-php-object-injection-via-ci-session"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source",
"unsupported-when-assigned"
],
"title": "MaxSite CMS through 109.6 PHP Object Injection via ci_session",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87930",
"datePublished": "2026-09-09T16:45:00.798Z",
"dateReserved": "2026-09-09T16:12:38.084Z",
"dateUpdated": "2026-09-09T17:24:57.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87929 (GCVE-0-2026-87929)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:45 – Updated: 2026-09-09 16:45 X_Open Source Unsupported When Assigned
VLAI
EPSS
VEX
Title
MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key
Summary
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions.
Severity
9.8 (Critical)
CWE
- CWE-321 - Use of Hard-coded Cryptographic Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maxsite/cms | product |
| https://github.com/EviL0rd/maxsite-cve4/blob/main… | exploittechnical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://www.vulncheck.com/advisories/maxsite-cms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MaxSite | MaxSite CMS |
Affected:
0.78 , ≤ 109.6
(custom)
cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/maxsite/cms",
"product": "MaxSite CMS",
"repo": "https://github.com/maxsite/cms",
"vendor": "MaxSite",
"versions": [
{
"lessThanOrEqual": "109.6",
"status": "affected",
"version": "0.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "109.6",
"versionStartIncluding": "0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EVIL0RD"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-321",
"description": "Use of Hard-coded Cryptographic Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:45:00.096Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/maxsite/cms"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/EviL0rd/maxsite-cve4/blob/main/2026.09.08-maxsite-cms-hardcoded-session-key-auth-bypass.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/config/config.php#L230-L254"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/maxsite/common/core/init.php#L70-L96"
},
{
"name": "VulnCheck Advisory: MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maxsite-cms-through-109.6-authentication-bypass-via-hardcoded-encryption-key"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source",
"unsupported-when-assigned"
],
"title": "MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87929",
"datePublished": "2026-09-09T16:45:00.096Z",
"dateReserved": "2026-09-09T16:12:31.422Z",
"dateUpdated": "2026-09-09T16:45:00.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87928 (GCVE-0-2026-87928)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:44 – Updated: 2026-09-09 16:44 X_Open Source Unsupported When Assigned
VLAI
EPSS
VEX
Title
MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page
Summary
MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks.
Severity
5.4 (Medium)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maxsite/cms | product |
| https://github.com/EviL0rd/maxsite-cve2/blob/main… | exploittechnical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://www.vulncheck.com/advisories/maxsite-cms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MaxSite | MaxSite CMS |
Affected:
0.94 , ≤ 109.6
(custom)
cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/maxsite/cms",
"product": "MaxSite CMS",
"repo": "https://github.com/maxsite/cms",
"vendor": "MaxSite",
"versions": [
{
"lessThanOrEqual": "109.6",
"status": "affected",
"version": "0.94",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "109.6",
"versionStartIncluding": "0.94",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EVIL0RD"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors\u0027 browsers when the file is accessed, enabling persistent stored cross-site scripting attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:44:59.356Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/maxsite/cms"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/EviL0rd/maxsite-cve2/blob/main/2026.09.08-maxsite-cms-arbitrary-file-write-stored-xss.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/maxsite/admin/plugins/admin_page/uploads-require-maxsite.php#L1-L64"
},
{
"name": "VulnCheck Advisory: MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maxsite-cms-0.94-through-109.6-html-upload-xss-via-admin-page"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source",
"unsupported-when-assigned"
],
"title": "MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87928",
"datePublished": "2026-09-09T16:44:59.356Z",
"dateReserved": "2026-09-09T16:12:25.344Z",
"dateUpdated": "2026-09-09T16:44:59.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87927 (GCVE-0-2026-87927)
Vulnerability from cvelistv5 – Published: 2026-09-09 16:44 – Updated: 2026-09-09 18:08 X_Open Source Unsupported When Assigned
VLAI
EPSS
VEX
Title
MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
Summary
MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 18:08 UTC
CWE
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maxsite/cms | product |
| https://github.com/EviL0rd/maxsite-cve1/blob/main… | exploittechnical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://github.com/maxsite/cms/blob/2ca0a0c7d1d71… | technical-description |
| https://www.vulncheck.com/advisories/maxsite-cms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MaxSite | MaxSite CMS |
Affected:
0.78 , ≤ 109.6
(custom)
cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87927",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T18:08:01.250640Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T18:08:20.929Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/maxsite/cms",
"product": "MaxSite CMS",
"repo": "https://github.com/maxsite/cms",
"vendor": "MaxSite",
"versions": [
{
"lessThanOrEqual": "109.6",
"status": "affected",
"version": "0.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:max-3000:maxsite_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "109.6",
"versionStartIncluding": "0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EVIL0RD"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execute admin-gated handler actions without authentication to access sensitive functionality."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:44:58.374Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/maxsite/cms"
},
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/EviL0rd/maxsite-cve1/blob/main/2026.09.08-maxsite-cms-ajax-lfi-path-traversal.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/views/ajax.php#L17-L42"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maxsite/cms/blob/2ca0a0c7d1d71106a25dbb0f2aedaaefbf12802c/application/views/require-maxsite.php#L13-L29"
},
{
"name": "VulnCheck Advisory: MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maxsite-cms-through-109.6-local-file-inclusion-via-ajax-dispatcher"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source",
"unsupported-when-assigned"
],
"title": "MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87927",
"datePublished": "2026-09-09T16:44:58.374Z",
"dateReserved": "2026-09-09T16:12:19.611Z",
"dateUpdated": "2026-09-09T18:08:20.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-26212 (GCVE-0-2026-26212)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:50 – Updated: 2026-09-09 14:50 X_Open Source
VLAI
EPSS
VEX
Title
Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE
Summary
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.
Severity
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.com/plugins/rara-one-click-demo… | product |
| https://www.vulncheck.com/advisories/rara-one-cli… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Rara Themes | Rara One Click Demo Import |
Affected:
0 , < 1.3.5
(semver)
|
Date Public
2026-09-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rara One Click Demo Import",
"vendor": "Rara Themes",
"versions": [
{
"lessThan": "1.3.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Rinesa Krasniqi"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core\u0027s file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:50:33.000Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Plugin Webpage",
"tags": [
"product"
],
"url": "https://wordpress.com/plugins/rara-one-click-demo-import"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rara-one-click-demo-import-arbitrary-file-upload-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Rara One Click Demo Import \u003c 1.3.5 Arbitrary File Upload RCE",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-26212",
"datePublished": "2026-09-09T14:50:33.000Z",
"dateReserved": "2026-02-11T20:08:07.942Z",
"dateUpdated": "2026-09-09T14:50:33.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87877 (GCVE-0-2026-87877)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 15:57
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()
Summary
zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:57 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/f38f9a15… | patch |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87877",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T15:57:38.917828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T15:57:53.652Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:45.512Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2jw3-mg7f-vw4q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-2jw3-mg7f-vw4q"
},
{
"name": "Fix commit: closed-state guards on BaseZstdBufferDecompressingStreamNoFinalizer",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/f38f9a1563113d96d0fc38baee543f7457dd8a8e"
},
{
"name": "Fix commit: closed-state guards on the input and output stream setters",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Setters without the closed-state guard that readInternal already has, at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "final stream handle retained after close at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict write through the retained native stream handle (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-via-setters-called-after-close"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close()",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87877",
"datePublished": "2026-09-09T14:32:45.512Z",
"dateReserved": "2026-09-09T14:02:07.708Z",
"dateUpdated": "2026-09-09T15:57:53.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87825 (GCVE-0-2026-87825)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries
Summary
zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes.
Severity
CWE
- CWE-416 - Use After Free
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/393d7311… | patch |
| https://github.com/luben/zstd-jni/commit/a560131d… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/0827ed02… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.8-4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary\u0027s shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.795Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-947w-pxjj-c7m9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-947w-pxjj-c7m9"
},
{
"name": "Fix commit: hold the dictionary shared lock for the stream\u0027s usage window",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/393d7311766abbc285b149302c0fe1f94b16d555"
},
{
"name": "Fix commit: cross-object lifetime tracking for dictionaries and contexts",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/a560131d7834598afd9cea6b7c107bc88e915936"
},
{
"name": "Shared lock released as soon as the dictionary is loaded at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/ZstdInputStreamNoFinalizer.java"
},
{
"name": "Same lock lifecycle in the buffer stream base class at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/BaseZstdBufferDecompressingStreamNoFinalizer.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that made setDict load the dictionary eagerly into the native context (first released in 1.3.8-4)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/0827ed02551bbd8d6f8e4bbff99d83bf50f91938"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.8-4-through-1.5.7-13-use-after-free-of-compression-and-decompression-dictionaries"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87825",
"datePublished": "2026-09-09T14:32:44.795Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87824 (GCVE-0-2026-87824)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect
Summary
zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/bba6cfca… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/53d3c634… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.3… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.3.3-1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:44.099Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-257p-3h6w-pg7h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-257p-3h6w-pg7h"
},
{
"name": "Fix commit: validate the samples buffer capacity against the declared sample sizes",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/bba6cfca2c0897f1fa004f4193247479f10da853"
},
{
"name": "Samples buffer capacity never read at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zdict.c"
},
{
"name": "Java wrapper that only checks the sample count at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the direct-buffer dictionary trainer without a samples capacity check (first released in 1.3.3-1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/53d3c6342883f7d6717b2477a7f9c1b4a4a56980"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.3.3-1-through-1.5.7-13-out-of-bounds-read-via-zstd-trainfrombufferdirect"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87824",
"datePublished": "2026-09-09T14:32:44.099Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:44.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87823 (GCVE-0-2026-87823)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 16:13
VLAI
EPSS
VEX
Title
zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods
Summary
zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 16:12 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/luben/zstd-jni/security/adviso… | vendor-advisory |
| https://github.com/luben/zstd-jni/commit/d7a1c993… | patch |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/blob/v1.5.7-13/… | technical-description |
| https://github.com/luben/zstd-jni/releases/tag/v1… | release-notes |
| https://github.com/luben/zstd-jni/commit/46dcb2a5… | technical-descriptionpatch |
| https://github.com/luben/zstd-jni | product |
| https://www.vulncheck.com/advisories/zstd-jni-1.1… | third-party-advisory |
Impacted products
Date Public
2026-08-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87823",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T16:12:29.082517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T16:13:14.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/github/luben/zstd-jni/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.github.luben/zstd-jni",
"product": "zstd-jni",
"repo": "https://github.com/luben/zstd-jni",
"vendor": "luben",
"versions": [
{
"lessThan": "1.5.7-14",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:43.442Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jfr6-9xqw-2g2q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/luben/zstd-jni/security/advisories/GHSA-jfr6-9xqw-2g2q"
},
{
"name": "Fix commit: reject negative offset and size in the three direct-ByteBuffer natives",
"tags": [
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/d7a1c99322d5e1fc71932e722c0b5bb2fc525d3f"
},
{
"name": "Unchecked 32-bit bounds tests at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/native/jni_zstd.c"
},
{
"name": "Native declarations with no Java-side validation at v1.5.7-13",
"tags": [
"technical-description"
],
"url": "https://github.com/luben/zstd-jni/blob/v1.5.7-13/src/main/java/com/github/luben/zstd/Zstd.java"
},
{
"name": "zstd-jni v1.5.7-14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/luben/zstd-jni/releases/tag/v1.5.7-14"
},
{
"name": "Commit that introduced the unchecked direct-ByteBuffer size natives (first released in 1.1.1)",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/luben/zstd-jni/commit/46dcb2a54c8b8f2ce2cad7187a7513f509c533ac"
},
{
"tags": [
"product"
],
"url": "https://github.com/luben/zstd-jni"
},
{
"name": "VulnCheck Advisory: zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zstd-jni-1.1.1-through-1.5.7-13-out-of-bounds-read-via-direct-bytebuffer-frame-size-methods"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87823",
"datePublished": "2026-09-09T14:32:43.442Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T16:13:14.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87822 (GCVE-0-2026-87822)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes
Summary
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations.
Severity
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tdunning/t-digest/issues/229 | issue-tracking |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest/blob/8d5c152… | technical-description |
| https://github.com/tdunning/t-digest | product |
| https://www.vulncheck.com/advisories/t-digest-3.1… | third-party-advisory |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo1.maven.org/maven2/com/tdunning/t-digest/",
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.tdunning/t-digest",
"product": "t-digest",
"repo": "https://github.com/tdunning/t-digest",
"vendor": "tdunning",
"versions": [
{
"lessThanOrEqual": "3.3",
"status": "affected",
"version": "3.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:42.726Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "tdunning/t-digest issue #229",
"tags": [
"issue-tracking"
],
"url": "https://github.com/tdunning/t-digest/issues/229"
},
{
"name": "fromBytes writing centroid means with no NaN check at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/MergingDigest.java"
},
{
"name": "stableQuickSort three-way partition that degrades on NaN at the 3.3 release commit",
"tags": [
"technical-description"
],
"url": "https://github.com/tdunning/t-digest/blob/8d5c1523c3d46925e9b3979a8d63c0b9d004ed1c/core/src/main/java/com/tdunning/math/stats/Sort.java"
},
{
"tags": [
"product"
],
"url": "https://github.com/tdunning/t-digest"
},
{
"name": "VulnCheck Advisory: t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/t-digest-3.1-through-3.3-denial-of-service-via-nan-centroid-means-in-mergingdigest-frombytes"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-87822",
"datePublished": "2026-09-09T14:32:42.726Z",
"dateReserved": "2026-09-09T10:32:34.110Z",
"dateUpdated": "2026-09-09T14:32:42.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82530 (GCVE-0-2026-82530)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:10 – Updated: 2026-09-09 14:30 X_Open Source
VLAI
EPSS
VEX
Title
IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header
Summary
IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:29 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/ip2location-country… | release-notes |
| https://www.vulncheck.com/advisories/ip2location-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IP2Location | IP2Location Country Blocker |
Affected:
0 , < 2.45.0
(semver)
|
Date Public
2026-09-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:29:23.210572Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:30:42.342Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "IP2Location Country Blocker",
"vendor": "IP2Location",
"versions": [
{
"lessThan": "2.45.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "AmirSUN"
}
],
"datePublic": "2026-09-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allows unauthenticated remote attackers to circumvent IP-based restrictions by forging the X-Real-IP HTTP header. Attackers can set the X-Real-IP header to an allowlisted IP address to bypass page, link, or site-wide access restrictions and access otherwise-blocked resources."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:10:56.654Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Plugin Changelog",
"tags": [
"release-notes"
],
"url": "https://wordpress.org/plugins/ip2location-country-blocker/#developers"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ip2location-country-blocker-access-control-bypass-via-x-real-ip-header"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "IP2Location Country Blocker \u003c 2.45.0 Access Control Bypass via X-Real-IP Header",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82530",
"datePublished": "2026-09-09T14:10:56.654Z",
"dateReserved": "2026-08-29T17:20:57.082Z",
"dateUpdated": "2026-09-09T14:30:42.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86775 (GCVE-0-2026-86775)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
knowns before 0.30.0 Path Traversal via Document API
Summary
knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+".md") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {"path": "../../../../tmp/knowns_pwn_marker"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects' documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/knowns-dev/knowns/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/knowns-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| knowns-dev | knowns |
Affected:
0 , < 0.30.0
(semver)
Unaffected: 0.30.0 (semver) |
Date Public
2026-08-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/knowns",
"product": "knowns",
"vendor": "knowns-dev",
"versions": [
{
"lessThan": "0.30.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.30.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "uziii2208"
},
{
"lang": "en",
"type": "reporter",
"value": "hoanggxyuuki"
}
],
"datePublic": "2026-08-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "knowns (npm package) versions \u003c= 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath(), which strips leading/trailing slashes and the .md suffix but does not neutralize ../ traversal sequences, and internal/storage/doc_store.go then builds the target path with filepath.Join(ds.docsDir(), filepath.FromSlash(doc.Path)+\".md\") without verifying that the resolved path remains inside the documents directory. In the default deployment, where the Management API is unauthenticated and bound to all interfaces, a remote unauthenticated attacker can supply a traversal payload (for example {\"path\": \"../../../../tmp/knowns_pwn_marker\"} to POST /api/docs, or an encoded path to GET /api/docs/...) to read, create, overwrite, or delete arbitrary files with a .md extension anywhere on the host filesystem and to create arbitrary directories via os.MkdirAll. This can expose sensitive data stored in other projects\u0027 documentation, corrupt or destroy files, and provide an arbitrary-write primitive that may be chained toward code execution. The issue is fixed in version 0.30.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:30.764Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3h35-4jq7-hv45)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/knowns-dev/knowns/security/advisories/GHSA-3h35-4jq7-hv45"
},
{
"name": "VulnCheck Advisory: knowns before 0.30.0 Path Traversal via Document API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/knowns-before-0.30.0-path-traversal-via-document-api"
}
],
"title": "knowns before 0.30.0 Path Traversal via Document API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86775",
"datePublished": "2026-09-09T13:32:30.764Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T13:32:30.764Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86774 (GCVE-0-2026-86774)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
Summary
Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.
Severity
6.3 (Medium)
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "adamyordan"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:30.059Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rhrf-7x22-x2rj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-rhrf-7x22-x2rj"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-broken-access-control-via-assetmodelpolicy"
}
],
"title": "Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86774",
"datePublished": "2026-09-09T13:32:30.059Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T13:32:30.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86773 (GCVE-0-2026-86773)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:32
VLAI
EPSS
VEX
Title
Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Summary
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:32 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86773",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:32:19.102793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:32:43.294Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "boboboboo"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object\u0027s name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:29.323Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4j5f-mm59-hf9w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w"
},
{
"name": "VulnCheck Advisory: Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-broken-access-control-via-kit-update-endpoints"
}
],
"title": "Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86773",
"datePublished": "2026-09-09T13:32:29.323Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T14:32:43.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86772 (GCVE-0-2026-86772)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT 8.6.3 Stored XSS via Department Names
Summary
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "marin-syn"
},
{
"lang": "en",
"type": "reporter",
"value": "ya3raj"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink() where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject malicious scripts into department names that execute in the browsers of all department members when they load their My Assets page."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:28.624Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3j84-c68v-g76m)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-3j84-c68v-g76m"
},
{
"name": "VulnCheck Advisory: Snipe-IT 8.6.3 Stored XSS via Department Names",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-stored-xss-via-department-names"
}
],
"title": "Snipe-IT 8.6.3 Stored XSS via Department Names",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86772",
"datePublished": "2026-09-09T13:32:28.624Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T13:32:28.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86771 (GCVE-0-2026-86771)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:06
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
Summary
Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:05 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86771",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:05:51.358839Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:06:59.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ya3raj"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF\u0027s writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:27.929Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-73xg-j94v-gjcf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-73xg-j94v-gjcf"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-server-side-request-forgery-via-employee-num"
}
],
"title": "Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86771",
"datePublished": "2026-09-09T13:32:27.929Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T14:06:59.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86770 (GCVE-0-2026-86770)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation
Summary
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.
Severity
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "William957-web"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:27.262Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w3vv-5wxh-xg4h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-w3vv-5wxh-xg4h"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-saml-username-collation"
}
],
"title": "Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86770",
"datePublished": "2026-09-09T13:32:27.262Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T13:32:27.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86769 (GCVE-0-2026-86769)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
Summary
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables_users pivot table, obscuring which operator performed the action.
Severity
4.3 (Medium)
CWE
- CWE-282 - Improper Ownership Management
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "5h1kh4r"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user\u0027s id in the created_by column instead of the authenticated caller\u0027s id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables_users pivot table, obscuring which operator performed the action."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-282",
"description": "Improper Ownership Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:26.577Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x9p8-vvc5-q754)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-x9p8-vvc5-q754"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-audit-log-misattribution-via-consumables-checkout"
}
],
"title": "Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86769",
"datePublished": "2026-09-09T13:32:26.577Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T13:32:26.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86768 (GCVE-0-2026-86768)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:31
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
Summary
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:31 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86768",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:31:10.631933Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:31:38.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "5h1kh4r"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:25.880Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qffp-xpqv-gqr4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Improper Input Validation via API Checkout",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-improper-input-validation-via-api-checkout"
}
],
"title": "Snipe-IT before 8.7.0 Improper Input Validation via API Checkout",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86768",
"datePublished": "2026-09-09T13:32:25.880Z",
"dateReserved": "2026-09-08T11:35:02.617Z",
"dateUpdated": "2026-09-09T14:31:38.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86767 (GCVE-0-2026-86767)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
Summary
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "khoadb175"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:25.202Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fxm8-w79r-g7wr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fxm8-w79r-g7wr"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Cross-Company Read via requested-assets",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-cross-company-read-via-requested-assets"
}
],
"title": "Snipe-IT before 8.7.0 Cross-Company Read via requested-assets",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86767",
"datePublished": "2026-09-09T13:32:25.202Z",
"dateReserved": "2026-09-08T11:33:02.642Z",
"dateUpdated": "2026-09-09T13:32:25.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86766 (GCVE-0-2026-86766)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:18
VLAI
EPSS
VEX
Title
Snipe-IT 8.6.3 Race Condition via Consumable Checkout
Summary
Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without locking the consumable row or re-checking availability. An authenticated user with permission to check out consumables can submit concurrent checkout requests for the same consumable so that both requests pass the availability check and succeed, over-allocating stock and driving the remaining inventory negative (e.g., a consumable with 1 remaining unit ends at -1 after two concurrent 1-unit checkouts). The issue is fixed in 8.7.0, which re-fetches the parent row under lockForUpdate inside the transaction and re-validates availability.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:08 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://github.com/grokability/snipe-it/commit/f7… | patch |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86766",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:08:27.655436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:18:02.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nullbenny"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without locking the consumable row or re-checking availability. An authenticated user with permission to check out consumables can submit concurrent checkout requests for the same consumable so that both requests pass the availability check and succeed, over-allocating stock and driving the remaining inventory negative (e.g., a consumable with 1 remaining unit ends at -1 after two concurrent 1-unit checkouts). The issue is fixed in 8.7.0, which re-fetches the parent row under lockForUpdate inside the transaction and re-validates availability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:24.528Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x4g2-87xc-m5jm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206"
},
{
"name": "VulnCheck Advisory: Snipe-IT 8.6.3 Race Condition via Consumable Checkout",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-race-condition-via-consumable-checkout"
}
],
"title": "Snipe-IT 8.6.3 Race Condition via Consumable Checkout",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86766",
"datePublished": "2026-09-09T13:32:24.528Z",
"dateReserved": "2026-09-08T11:33:02.642Z",
"dateUpdated": "2026-09-09T14:18:02.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86765 (GCVE-0-2026-86765)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
Summary
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned_location parameters to PATCH /api/v1/hardware/{id}.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://github.com/grokability/snipe-it/commit/f7… | patch |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nullbenny"
},
{
"lang": "en",
"type": "reporter",
"value": "builtbybrayden"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned_location parameters to PATCH /api/v1/hardware/{id}."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:23.837Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-6g2g-83pc-6365)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-6g2g-83pc-6365"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206"
},
{
"name": "VulnCheck Advisory: Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-authorization-bypass-via-asset-update-endpoint"
}
],
"title": "Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86765",
"datePublished": "2026-09-09T13:32:23.837Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T13:32:23.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86764 (GCVE-0-2026-86764)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
Summary
Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected — the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden for such users.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.4 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ashrexon"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/\u003casset-id\u003e/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response\u0027s available_actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected \u2014 the direct GET /api/v1/components/\u003cid\u003e endpoint correctly returns 403 Forbidden for such users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:23.152Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v973-fm42-f8xv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-v973-fm42-f8xv"
},
{
"name": "VulnCheck Advisory: Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.4-before-8.7.0-permission-bypass-via-assigned-components"
}
],
"title": "Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86764",
"datePublished": "2026-09-09T13:32:23.152Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T13:32:23.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86763 (GCVE-0-2026-86763)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:30
VLAI
EPSS
VEX
Title
snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
Summary
Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:30 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-7.0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
7.0.12 , ≤ 8.7.2
(semver)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86763",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:30:07.882516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:30:21.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThanOrEqual": "8.7.2",
"status": "affected",
"version": "7.0.12",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndIncluding": "8.7.2",
"versionStartIncluding": "7.0.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pavelkohout396"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions \u003e= 7.0.12 and \u003c= 8.6.3 contain an authorization bypass in the Livewire importer component (App\\Livewire\\Importer, mounted at the imports.index route). The component only checked the broad \u0027import\u0027 ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user\u0027s record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:22.445Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-89q3-jmfm-hvcm)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-89q3-jmfm-hvcm"
},
{
"name": "VulnCheck Advisory: snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-7.0.12-through-8.6.3-authorization-bypass-via-importer"
}
],
"title": "snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86763",
"datePublished": "2026-09-09T13:32:22.445Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T14:30:21.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86762 (GCVE-0-2026-86762)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
Summary
Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account's prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://github.com/grokability/snipe-it/commit/b3… | patch |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tahiniii"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user\u0027s Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its existing API token continues to authenticate and to grant read and write access to the REST API (assets, users, licenses, etc.) at the account\u0027s prior permission level until the token expires. A deactivated account that retains user-management permissions can re-activate itself through the API, permanently defeating the deactivation control."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:21.747Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cj4w-vx6j-42rf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cj4w-vx6j-42rf"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/grokability/snipe-it/commit/b3f12f974bb2c0175ea68dad163ed04726db4280"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Authentication Bypass via API Middleware",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authentication-bypass-via-api-middleware"
}
],
"title": "Snipe-IT before 8.7.0 Authentication Bypass via API Middleware",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86762",
"datePublished": "2026-09-09T13:32:21.747Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T13:32:21.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86761 (GCVE-0-2026-86761)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:21
VLAI
EPSS
VEX
Title
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Summary
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://github.com/grokability/snipe-it/commit/78… | patch |
| https://www.vulncheck.com/advisories/snipe-it-8.6… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.6.3 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86761",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:20:38.231057Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:21:08.479Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.6.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:21.065Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cg5w-9662-73vx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a"
},
{
"name": "VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints"
}
],
"title": "snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86761",
"datePublished": "2026-09-09T13:32:21.065Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T14:21:08.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86760 (GCVE-0-2026-86760)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag
Summary
Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit permission in the target's company scope can submit a full valid PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts. Deactivating an admin locks that account out of the application until another admin or superuser re-enables it. Only the activated field is affected; username, email, password and permissions remain protected by the gate, no data is disclosed, and the API (Api\UsersController::update) and bulk-edit paths are not affected.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://github.com/grokability/snipe-it/commit/02… | patch |
| https://www.vulncheck.com/advisories/snipe-it-8.2… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
8.2.0 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"versionStartIncluding": "8.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "m0xath"
},
{
"lang": "en",
"type": "reporter",
"value": "Vectrain51"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update(). The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an authenticated non-admin user holding the users.edit permission in the target\u0027s company scope can submit a full valid PUT request to /users/{id} and toggle the activated flag on any user, including admin and superuser accounts. Deactivating an admin locks that account out of the application until another admin or superuser re-enables it. Only the activated field is affected; username, email, password and permissions remain protected by the gate, no data is disclosed, and the API (Api\\UsersController::update) and bulk-edit paths are not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:20.375Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xq9q-777w-q9h7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-xq9q-777w-q9h7"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/grokability/snipe-it/commit/02f62c8dce7bee118a07882823cd1ad098360a17"
},
{
"name": "VulnCheck Advisory: snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-8.2.0-before-8.7.0-authentication-bypass-via-activated-flag"
}
],
"title": "snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86760",
"datePublished": "2026-09-09T13:32:20.375Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T13:32:20.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86759 (GCVE-0-2026-86759)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
Summary
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
0 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pavelkohout396"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:19.635Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2232-926w-qvr9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-2232-926w-qvr9"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-authorization-via-asset-history-csv-importer"
}
],
"title": "Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86759",
"datePublished": "2026-09-09T13:32:19.635Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T13:32:19.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86758 (GCVE-0-2026-86758)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:29
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 License Key Exposure via CSV Export
Summary
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:28 UTC
CWE
- CWE-204 - Observable Response Discrepancy
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
0 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86758",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:28:39.778561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:29:41.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pavelkohout396"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "Observable Response Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:18.956Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5jcj-c9p3-82q7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-5jcj-c9p3-82q7"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 License Key Exposure via CSV Export",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-license-key-exposure-via-csv-export"
}
],
"title": "Snipe-IT before 8.7.0 License Key Exposure via CSV Export",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86758",
"datePublished": "2026-09-09T13:32:18.956Z",
"dateReserved": "2026-09-08T11:33:02.641Z",
"dateUpdated": "2026-09-09T14:29:41.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86757 (GCVE-0-2026-86757)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 13:32
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
Summary
Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted_custom_fields permission check.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
0 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "pavelkohout396"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted_custom_fields permission check."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:18.289Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j36v-ghpr-m963)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-j36v-ghpr-m963"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Information Disclosure via Custom Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-information-disclosure-via-custom-fields"
}
],
"title": "Snipe-IT before 8.7.0 Information Disclosure via Custom Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86757",
"datePublished": "2026-09-09T13:32:18.289Z",
"dateReserved": "2026-09-08T11:32:11.096Z",
"dateUpdated": "2026-09-09T13:32:18.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}