EUVD-2026-335951

fkie_cve-2026-55462

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and printInventory() authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, allowing an authenticated user with only users.view to see inventory and cost/order metadata from modules that direct permissions would otherwise deny. This issue is fixed in version 8.6.2.

GHSA-fc33-6w3q-538h — Snipe-IT has an authorization bypass on print inventory page

Affected: Packagist: snipe/snipe-it

### Impact An authenticated user with only `users.view` can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license names, purchase order/order values, accessory and consumable names, assignment notes, and purchase costs.

### Attacker Model

Authenticated user with only:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json {"users.view":"1"} ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The attacker does not have:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json { "licenses.view": "1", "accessories.view": "1", "consumables.view": "1", "assets.view": "1" } ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

### Affected Component

- `app/Http/Controllers/Users/UsersController.php`

- `resources/views/users/view.blade.php`

- `resources/views/users/print.blade.php`

- Endpoints:

- `GET /users/{user}`

- `GET /users/{user}/print`

### Root Cause

`UsersController::show()` authorizes only viewing the user, then loads inventory relationships:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ php $this->authorize('view', $user);

$user = User::with([ 'consumables', 'accessories', 'licenses', 'userloc',…

WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Dateien zu manipulieren, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.

Most recent entries from all

EUVD-2026-335951

fkie_cve-2026-55462

GHSA-fc33-6w3q-538h — Snipe-IT has an authorization bypass on print inventory page

WID-SEC-W-2026-2073 — Snipe-IT: Mehrere Schwachstellen