# Snipeitapp vulnerabilities Source: https://junglewise.ai/threats/vendors/snipeitapp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/snipeitapp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 61 vulnerabilities in Snipeitapp: 0 in the last 7 days and 54 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-86774, was published on 9 September 2026. Nothing was published in the last eight weeks. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 54 - All time: 61 (2 critical, 0 exploited in the wild) ## About Snipeitapp Open source IT asset management and inventory tracking application. ## Latest Snipeitapp vulnerabilities - [CVE-2026-86774: Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments) (medium, CVSS 6.3, published 9 Sep 2026) - [CVE-2026-86773: Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86772: Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86771: Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped) (high, CVSS 7.6, published 9 Sep 2026) - [CVE-2026-86770: Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation) (high, CVSS 8.1, published 9 Sep 2026) - [CVE-2026-86769: Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86768: Snipe-IT API checkout endpoints improper input validation](https://junglewise.ai/threats/cve-2026-86768-snipe-it-api-checkout-endpoints-improper-input-validation) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86767: Snipe-IT unauthorized cross-company read in requested assets](https://junglewise.ai/threats/cve-2026-86767-snipe-it-unauthorized-cross-company-read-in-requested-assets) (medium, CVSS 5, published 9 Sep 2026) - [CVE-2026-86766: Snipe-IT consumable checkout race condition](https://junglewise.ai/threats/cve-2026-86766-snipe-it-consumable-checkout-race-condition) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86765: Snipe-IT authorization bypass in asset update endpoint](https://junglewise.ai/threats/cve-2026-86765-snipe-it-authorization-bypass-in-asset-update-endpoint) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86764: Snipe-IT permission bypass in assigned components endpoint](https://junglewise.ai/threats/cve-2026-86764-snipe-it-permission-bypass-in-assigned-components-endpoint) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86763: Snipe-IT Livewire importer authorization bypass](https://junglewise.ai/threats/cve-2026-86763-snipe-it-livewire-importer-authorization-bypass) (low, CVSS 3.5, published 9 Sep 2026) - [CVE-2026-86762: Snipe-IT authentication bypass via deactivated user API tokens](https://junglewise.ai/threats/cve-2026-86762-snipe-it-authentication-bypass-via-deactivated-user-api-tokens) (high, CVSS 8.1, published 9 Sep 2026) - [CVE-2026-86761: Snipe-IT authorization bypass in location print endpoints](https://junglewise.ai/threats/cve-2026-86761-snipe-it-authorization-bypass-in-location-print-endpoints) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86760: Snipe-IT authorization bypass in user account activation toggle](https://junglewise.ai/threats/cve-2026-86760-snipe-it-authorization-bypass-in-user-account-activation-toggle) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86759: Snipe-IT missing authorization in asset-history CSV importer](https://junglewise.ai/threats/cve-2026-86759-snipe-it-missing-authorization-in-asset-history-csv-importer) (high, CVSS 7.1, published 9 Sep 2026) - [CVE-2026-86758: Snipe-IT authorization bypass in license key export](https://junglewise.ai/threats/cve-2026-86758-snipe-it-authorization-bypass-in-license-key-export) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86757: Snipe-IT authorization bypass in encrypted custom field form rendering](https://junglewise.ai/threats/cve-2026-86757-snipe-it-authorization-bypass-in-encrypted-custom-field-form) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-86756: Snipe-IT open redirect in SAML RelayState parameter](https://junglewise.ai/threats/cve-2026-86756-snipe-it-open-redirect-in-saml-relaystate-parameter) (medium, CVSS 6.1, published 9 Sep 2026) - [CVE-2026-86755: Snipe-IT permission bypass in Passport personal-access-token routes](https://junglewise.ai/threats/cve-2026-86755-snipe-it-permission-bypass-in-passport-personal-access-token) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86754: Snipe-IT authorization bypass in OAuth client management](https://junglewise.ai/threats/cve-2026-86754-snipe-it-authorization-bypass-in-oauth-client-management) (high, CVSS 7.3, published 9 Sep 2026) - [CVE-2026-86753: snipe-it business logic bypass in asset model request endpoint](https://junglewise.ai/threats/cve-2026-86753-snipe-it-business-logic-bypass-in-asset-model-request-endpoint) (medium, CVSS 4.3, published 9 Sep 2026) - [CVE-2026-86752: snipe-it asset audit endpoints authorization bypass](https://junglewise.ai/threats/cve-2026-86752-snipe-it-asset-audit-endpoints-authorization-bypass) (medium, CVSS 5.4, published 9 Sep 2026) - [CVE-2026-86751: Snipe-IT markdown image injection in mail notifications](https://junglewise.ai/threats/cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications) (high, CVSS 8.5, published 9 Sep 2026) - [CVE-2026-86750: Snipe-IT authorization bypass in user REST API](https://junglewise.ai/threats/cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api) (high, CVSS 7.7, published 9 Sep 2026) ## Most severe Snipeitapp vulnerabilities - [CVE-2025-63601: Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to…](https://junglewise.ai/threats/cve-2025-63601-snipe-it-before-version-8-3-3-contains-a-remote-code-execution) (critical, CVSS 9.9, published 5 Nov 2025) - [CVE-2026-37709: Grokability Snipe-IT insecure permissions in UploadedFilesController](https://junglewise.ai/threats/cve-2026-37709-grokability-snipe-it-insecure-permissions-in) (critical, CVSS 9.8, published 7 May 2026) - [CVE-2026-85617: snipe-it authorization bypass in bulk delete](https://junglewise.ai/threats/cve-2026-85617-snipe-it-authorization-bypass-in-bulk-delete) (high, CVSS 8.8, published 4 Sep 2026) - [CVE-2025-15602: Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass…](https://junglewise.ai/threats/cve-2025-15602-snipe-it-has-sensitive-user-attributes-related-to-account) (high, CVSS 8.8, published 6 Mar 2026) - [CVE-2026-55643: Snipe-IT tenant isolation bypass in authorization checks](https://junglewise.ai/threats/cve-2026-55643-snipe-it-tenant-isolation-bypass-in-authorization-checks) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-55483: Snipe-IT privilege escalation in UsersController user creation](https://junglewise.ai/threats/cve-2026-55483-snipe-it-privilege-escalation-in-userscontroller-user-creation) (high, CVSS 8.8, published 19 Aug 2026) - [CVE-2026-86738: Snipe-IT CSS injection in custom CSS field](https://junglewise.ai/threats/cve-2026-86738-snipe-it-css-injection-in-custom-css-field) (high, CVSS 8.7, published 8 Sep 2026) - [CVE-2026-85616: Snipe-IT authorization bypass in checkout-acceptance report](https://junglewise.ai/threats/cve-2026-85616-snipe-it-authorization-bypass-in-checkout-acceptance-report) (high, CVSS 8.5, published 4 Sep 2026) - [CVE-2026-86751: Snipe-IT markdown image injection in mail notifications](https://junglewise.ai/threats/cve-2026-86751-snipe-it-markdown-image-injection-in-mail-notifications) (high, CVSS 8.5, published 9 Sep 2026) - [CVE-2026-86741: Snipe-IT arbitrary file read and SSRF via category EULA](https://junglewise.ai/threats/cve-2026-86741-snipe-it-arbitrary-file-read-and-ssrf-via-category-eula) (high, CVSS 8.5, published 9 Sep 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 10 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 42 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Snipeitapp technologies - [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it): 93 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Snipeitapp vulnerabilities", https://junglewise.ai/threats/vendors/snipeitapp, 12 November 2026.