Most recent entries from all

EUVD-2026-357531

fkie_cve-2026-48507

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

GHSA-6f75-x745-xcpr — Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Affected: Packagist: snipe/snipe-it

### Impact The vulnerability allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset.

### Patches Patched in https://github.com/grokability/snipe-it/commit/403f9c848b05274642f64450696bdcdc242a352a

WID-SEC-W-2026-1692 — Snipe-IT: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um Informationen offenzulegen, um seine Privilegien zu erhöhen, und um Daten zu manipulieren.