https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T18:25:47.313792+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-357531 EUVD-2026-357531 2026-10-12T18:25:47.316590+00:00 EUVD-2026-357531 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48507 fkie_cve-2026-48507 2026-10-12T18:25:47.316623+00:00

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-6f75-x745-xcpr GHSA-6f75-x745-xcpr — Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users 2026-10-12T18:25:47.316655+00:00

Affected: Packagist: snipe/snipe-it

### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.

### Patches Patched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1692 WID-SEC-W-2026-1692 — Snipe-IT: Mehrere Schwachstellen 2026-10-12T18:25:47.316684+00:00

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, und um Daten zu manipulieren.