Snipe-IT: Mehrere Schwachstellen
WID-SEC-2026-2981 · first 25.08.2026 · updated 25.09.2026 · CVSS 9,6
What it is about
Snipe-IT ist eine webbasierte Open-Source-Asset-Management-Software, die Unternehmen bei der Verfolgung von Hardware und Software unterstützt. Ein Angreifer kann mehrere Schwachstellen in Snipe-IT ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe zu starten, sensible Informationen offenzulegen, Daten zu manipulieren, Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Code auszuführen
- erweiterte Berechtigungen zu erlangen
- Sicherheitsmaßnahmen zu umgehen
- Cross-Site-Scripting-Angriffe zu starten
- sensible Informationen offenzulegen
- Daten zu manipulieren
- Konten zu übernehmen oder Denial-of-Service-Zustände herbeizuführen
Am I affected?
Affected according to the BSI:
- Open Source Snipe-IT <8.7.0
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Snipe-IT 8.7.0
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- Grokability Snipe-IT Releases vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-2232-926w-qvr9 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-396x-xmvh-p563 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-3j84-c68v-g76m vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-4c4h-cpgf-h4qr vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-4cr5-3hw8-8w5f vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-4j5f-mm59-hf9w vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-4vcv-fc5x-jjwv vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-5j6m-rr83-rpj7 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-5jcj-c9p3-82q7 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-68hq-m589-8q9j vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-6f4g-phw5-4g77 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-6g2g-83pc-6365 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-73xg-j94v-gjcf vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-76pf-qf59-ff3q vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-79jf-ppgj-5cc3 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-7xrr-xm47-rc6w vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-89q3-jmfm-hvcm vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-c929-qxg6-r3mc vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-cg5w-9662-73vx vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-cj4w-vx6j-42rf vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-f3vq-g24v-xc2g vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-fxm8-w79r-g7wr vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-gq7g-hxjg-8j27 vom 2026-08-24 github.com
- GitHub Security Advisory GHSA-h543-58f9-v6mj vom 2026-08-24 github.com
and 22 more sources in the original advisory
CVE: CVE-2026-62368, CVE-2026-63493, CVE-2026-63498, CVE-2026-84206, CVE-2026-86733, CVE-2026-86734, CVE-2026-86735, CVE-2026-86736, CVE-2026-86737, CVE-2026-86738, CVE-2026-86739, CVE-2026-86740, CVE-2026-86741, CVE-2026-86742, CVE-2026-86743, CVE-2026-86744, CVE-2026-86745, CVE-2026-86746, CVE-2026-86747, CVE-2026-86748 …
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.