# Snipeitapp Snipe-It vulnerabilities Source: https://junglewise.ai/threats/technologies/snipe-it Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 20:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/snipe-it.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 93 vulnerabilities in Snipeitapp Snipe-It: 0 in the last 7 days and 59 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-63498, was published on 24 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 59 - All time: 93 (2 critical, 0 exploited in the wild) ## About Snipeitapp Snipe-It IT asset management system for tracking and managing inventory of hardware and software. ## Latest Snipeitapp Snipe-It vulnerabilities - [CVE-2026-63498: Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files) (high, CVSS 8.7, published 24 Sep 2026) - [CVE-2026-63493: Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow) (high, CVSS 4, published 24 Sep 2026) - [CVE-2026-62368: Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names) (high, CVSS 8.1, published 24 Sep 2026) - [CVE-2026-88894: Snipe-IT predefined kit checkout FMCS tenant isolation bypass](https://junglewise.ai/threats/cve-2026-88894-snipe-it-predefined-kit-checkout-fmcs-tenant-isolation-bypass) (medium, CVSS 5.4, published 10 Sep 2026) - [CVE-2026-86774: Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments) (medium, CVSS 6.3, published 9 Sep 2026) - [CVE-2026-86773: Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86772: Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86771: Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped) (high, CVSS 7.6, published 9 Sep 2026) - [CVE-2026-86770: Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation) (high, CVSS 8.1, published 9 Sep 2026) - [CVE-2026-86769: Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86768: Snipe-IT API checkout endpoints improper input validation](https://junglewise.ai/threats/cve-2026-86768-snipe-it-api-checkout-endpoints-improper-input-validation) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86767: Snipe-IT unauthorized cross-company read in requested assets](https://junglewise.ai/threats/cve-2026-86767-snipe-it-unauthorized-cross-company-read-in-requested-assets) (medium, CVSS 5, published 9 Sep 2026) - [CVE-2026-86766: Snipe-IT consumable checkout race condition](https://junglewise.ai/threats/cve-2026-86766-snipe-it-consumable-checkout-race-condition) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86765: Snipe-IT authorization bypass in asset update endpoint](https://junglewise.ai/threats/cve-2026-86765-snipe-it-authorization-bypass-in-asset-update-endpoint) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86764: Snipe-IT permission bypass in assigned components endpoint](https://junglewise.ai/threats/cve-2026-86764-snipe-it-permission-bypass-in-assigned-components-endpoint) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86763: Snipe-IT Livewire importer authorization bypass](https://junglewise.ai/threats/cve-2026-86763-snipe-it-livewire-importer-authorization-bypass) (low, CVSS 3.5, published 9 Sep 2026) - [CVE-2026-86762: Snipe-IT authentication bypass via deactivated user API tokens](https://junglewise.ai/threats/cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens) (high, CVSS 8.1, published 9 Sep 2026) - [CVE-2026-86761: Snipe-IT authorization bypass in location print endpoints](https://junglewise.ai/threats/cve-2026-86761-snipe-it-authorization-bypass-in-location-print-endpoints) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86760: Snipe-IT authorization bypass in user account activation toggle](https://junglewise.ai/threats/cve-2026-86760-snipe-it-authorization-bypass-in-user-account-activation-toggle) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86759: Snipe-IT missing authorization in asset-history CSV importer](https://junglewise.ai/threats/cve-2026-86759-snipe-it-missing-authorization-in-asset-history-csv-importer) (high, CVSS 7.1, published 9 Sep 2026) - [CVE-2026-86758: Snipe-IT authorization bypass in license key export](https://junglewise.ai/threats/cve-2026-86758-snipe-it-authorization-bypass-in-license-key-export) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86757: Snipe-IT authorization bypass in encrypted custom field form rendering](https://junglewise.ai/threats/cve-2026-86757-snipe-it-authorization-bypass-in-encrypted-custom-field-form) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86756: Snipe-IT open redirect in SAML RelayState parameter](https://junglewise.ai/threats/cve-2026-86756-snipe-it-open-redirect-in-saml-relaystate-parameter) (medium, CVSS 6.1, published 9 Sep 2026) - [CVE-2026-86755: Snipe-IT permission bypass in Passport personal-access-token routes](https://junglewise.ai/threats/cve-2026-86755-snipe-it-permission-bypass-in-passport-personal-access-token) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86754: Snipe-IT authorization bypass in OAuth client management](https://junglewise.ai/threats/cve-2026-86754-snipe-it-authorization-bypass-in-oauth-client-management) (high, CVSS 7.3, published 9 Sep 2026) ## Most severe Snipeitapp Snipe-It vulnerabilities - [CVE-2025-63601: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to…](https://junglewise.ai/threats/cve-2025-63601-snipe-it-before-version-8-3-3-contains-a-remote-code-execution) (critical, CVSS 9.9, published 5 Nov 2025) - [CVE-2026-37709: Grokability Snipe-IT insecure permissions in UploadedFilesController](https://junglewise.ai/threats/cve-2026-37709-grokability-snipe-it-insecure-permissions-in) (critical, CVSS 9.8, published 7 May 2026) - [CVE-2022-23064: Snipe-IT host header injection in password reset](https://junglewise.ai/threats/cve-2022-23064-snipe-it-host-header-injection-in-password-reset) (high, CVSS 8.8, published 3 May 2022) - [CVE-2026-85617: snipe-it authorization bypass in bulk delete](https://junglewise.ai/threats/cve-2026-85617-snipe-it-authorization-bypass-in-bulk-delete) (high, CVSS 8.8, published 4 Sep 2026) - [CVE-2025-15602: Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass…](https://junglewise.ai/threats/cve-2025-15602-snipe-it-has-sensitive-user-attributes-related-to-account) (high, CVSS 8.8, published 6 Mar 2026) - [CVE-2026-55643: Snipe-IT tenant isolation bypass in authorization checks](https://junglewise.ai/threats/cve-2026-55643-snipe-it-tenant-isolation-bypass-in-authorization-checks) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-44832: Grokability Snipe-IT privilege escalation in Users API](https://junglewise.ai/threats/cve-2026-44832-grokability-snipe-it-privilege-escalation-in-users-api) (high, CVSS 8.8, published 26 May 2026) - [CVE-2026-55483: Snipe-IT privilege escalation in UsersController user creation](https://junglewise.ai/threats/cve-2026-55483-snipe-it-privilege-escalation-in-userscontroller-user-creation) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-86738: Snipe-IT CSS injection in custom CSS field](https://junglewise.ai/threats/cve-2026-86738-snipe-it-css-injection-in-custom-css-field) (high, CVSS 8.7, published 8 Sep 2026) - [CVE-2026-55466: Grokability Snipe-IT stored XSS in asset attachments](https://junglewise.ai/threats/cve-2026-55466-grokability-snipe-it-stored-xss-in-asset-attachments) (high, CVSS 8.7, published 10 Jul 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 10 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 43 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Snipeitapp Snipe-It vulnerabilities", https://junglewise.ai/threats/technologies/snipe-it, 11 November 2026.