{"schema_version":"2","view":"grouped","data":[{"id":45386,"cve_ids":["CVE-2026-114064"],"payload":{"kind":"advisory","title":"Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint","summary":"Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.","evidence":"cve:CVE-2026-114064","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114064","aliases":["CVE-2026-114064"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"0","lessThan":"8.7.0","versionType":"semver"},{"status":"unaffected","version":"8.7.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:37.528Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6","https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:37.528Z"}}},"related_cves":[{"value":"CVE-2026-114064","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2619ada0-1627-44ab-a56b-2981f1c03c25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114064","advisory_id":"2619ada0-1627-44ab-a56b-2981f1c03c25","event_types":["advisory"],"published_at":"2026-10-25T12:25:38.397881+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:37.528+00:00","detail_url":"/advisories/advisory%3A2619ada0-1627-44ab-a56b-2981f1c03c25","group":{"id":"advisory:2619ada0-1627-44ab-a56b-2981f1c03c25","revision":1,"primary_event_id":44952,"change":"published","superseded_by":[],"changed":{"id":44952,"cve_ids":["CVE-2026-114064"],"payload":{"kind":"advisory","title":"Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint","summary":"Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.","evidence":"cve:CVE-2026-114064","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114064","aliases":["CVE-2026-114064"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"0","lessThan":"8.7.0","versionType":"semver"},{"status":"unaffected","version":"8.7.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:37.528Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6","https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:37.528Z"}}},"related_cves":[{"value":"CVE-2026-114064","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2619ada0-1627-44ab-a56b-2981f1c03c25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114064","advisory_id":"2619ada0-1627-44ab-a56b-2981f1c03c25","event_types":["advisory"],"published_at":"2026-10-25T12:25:38.397881+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:37.528+00:00","detail_url":"/events/44952"},"members":[{"id":44952,"cve_ids":["CVE-2026-114064"],"payload":{"kind":"advisory","title":"Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint","summary":"Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.","evidence":"cve:CVE-2026-114064","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-114064","aliases":["CVE-2026-114064"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:L","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"HIGH","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"0","lessThan":"8.7.0","versionType":"semver"},{"status":"unaffected","version":"8.7.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T00:36:37.528Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6","https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint"],"provider_metadata":{"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-21T00:36:37.528Z"}}},"related_cves":[{"value":"CVE-2026-114064","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2619ada0-1627-44ab-a56b-2981f1c03c25","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-114064","advisory_id":"2619ada0-1627-44ab-a56b-2981f1c03c25","event_types":["advisory"],"published_at":"2026-10-25T12:25:38.397881+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-21T00:36:37.528+00:00","detail_url":"/events/44952"}]}},{"id":12688,"cve_ids":["CVE-2025-15602"],"payload":{"kind":"advisory","title":"Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation","summary":"Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.","evidence":"cve:CVE-2025-15602","products":[{"name":{"value":"Snipe-IT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2025-15602","aliases":["CVE-2025-15602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Grokability, Inc.","product":"Snipe-IT","versions":[{"status":"affected","version":"0","lessThan":"8.3.7","versionType":"semver"}],"packageURL":"pkg:composer/snipe/snipe-it","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:21:15.677Z","provider":"cve","references":["https://github.com/grokability/snipe-it/releases/tag/v8.3.7","https://snipeitapp.com/","https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-15602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-09T15:12:04.582716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-09T15:12:11.595Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:21:15.677Z"}}},"related_cves":[{"value":"CVE-2025-15602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:187ef2cb-9d14-466f-907e-540f8c52cc77","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-15602","advisory_id":"187ef2cb-9d14-466f-907e-540f8c52cc77","event_types":["advisory"],"published_at":"2026-10-25T00:10:31.652129+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-06T16:16:08.531+00:00","detail_url":"/advisories/advisory%3A187ef2cb-9d14-466f-907e-540f8c52cc77","group":{"id":"advisory:187ef2cb-9d14-466f-907e-540f8c52cc77","revision":1,"primary_event_id":12624,"change":"published","superseded_by":[],"changed":{"id":12624,"cve_ids":["CVE-2025-15602"],"payload":{"kind":"advisory","title":"Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation","summary":"Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.","evidence":"cve:CVE-2025-15602","products":[{"name":{"value":"Snipe-IT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2025-15602","aliases":["CVE-2025-15602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Grokability, Inc.","product":"Snipe-IT","versions":[{"status":"affected","version":"0","lessThan":"8.3.7","versionType":"semver"}],"packageURL":"pkg:composer/snipe/snipe-it","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:21:15.677Z","provider":"cve","references":["https://github.com/grokability/snipe-it/releases/tag/v8.3.7","https://snipeitapp.com/","https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-15602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-09T15:12:04.582716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-09T15:12:11.595Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:21:15.677Z"}}},"related_cves":[{"value":"CVE-2025-15602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:187ef2cb-9d14-466f-907e-540f8c52cc77","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-15602","advisory_id":"187ef2cb-9d14-466f-907e-540f8c52cc77","event_types":["advisory"],"published_at":"2026-10-25T00:10:31.652129+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-06T16:16:08.531+00:00","detail_url":"/events/12624"},"members":[{"id":12624,"cve_ids":["CVE-2025-15602"],"payload":{"kind":"advisory","title":"Snipe-IT < 8.3.7 Mass Assignment Vulnerability Leading to Privilege Escalation","summary":"Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An authenticated, low-privileged user can craft a malicious API request to modify restricted fields of another user account, including the Super Admin account. By changing the email address of the Super Admin and triggering a password reset, an attacker can fully take over the Super Admin account, resulting in complete administrative control of the Snipe-IT instance.","evidence":"cve:CVE-2025-15602","products":[{"name":{"value":"Snipe-IT","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2025-15602","aliases":["CVE-2025-15602"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":8.7,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Grokability, Inc.","product":"Snipe-IT","versions":[{"status":"affected","version":"0","lessThan":"8.3.7","versionType":"semver"}],"packageURL":"pkg:composer/snipe/snipe-it","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:21:15.677Z","provider":"cve","references":["https://github.com/grokability/snipe-it/releases/tag/v8.3.7","https://snipeitapp.com/","https://www.vulncheck.com/advisories/snipe-it-mass-assignment-vulnerability-leading-to-privilege-escalation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-15602","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-09T15:12:04.582716Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-03-09T15:12:11.595Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:21:15.677Z"}}},"related_cves":[{"value":"CVE-2025-15602","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:187ef2cb-9d14-466f-907e-540f8c52cc77","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-15602","advisory_id":"187ef2cb-9d14-466f-907e-540f8c52cc77","event_types":["advisory"],"published_at":"2026-10-25T00:10:31.652129+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-03-06T16:16:08.531+00:00","detail_url":"/events/12624"}]}},{"id":3369,"cve_ids":["CVE-2026-63493"],"payload":{"kind":"advisory","title":"Snipe-IT: 2FA bypass via the API token flow","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.","evidence":"cve:CVE-2026-63493","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63493","aliases":["CVE-2026-63493"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-29T02:54:32.742Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","https://github.com/grokability/snipe-it/pull/19294","https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e","https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T02:54:07.180253Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:54:32.742Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:37:09.832Z"}}},"related_cves":[{"value":"CVE-2026-63493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43ac1515-f475-4e6d-8d90-3fc9984f40a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63493","advisory_id":"43ac1515-f475-4e6d-8d90-3fc9984f40a2","event_types":["advisory"],"published_at":"2026-10-24T21:34:11.219687+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:37:09.832+00:00","detail_url":"/advisories/advisory%3A43ac1515-f475-4e6d-8d90-3fc9984f40a2","group":{"id":"advisory:43ac1515-f475-4e6d-8d90-3fc9984f40a2","revision":1,"primary_event_id":3383,"change":"published","superseded_by":[],"changed":{"id":3383,"cve_ids":["CVE-2026-63493"],"payload":{"kind":"advisory","title":"Snipe-IT: 2FA bypass via the API token flow","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.","evidence":"cve:CVE-2026-63493","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63493","aliases":["CVE-2026-63493"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-29T02:54:32.742Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","https://github.com/grokability/snipe-it/pull/19294","https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e","https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T02:54:07.180253Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:54:32.742Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:37:09.832Z"}}},"related_cves":[{"value":"CVE-2026-63493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43ac1515-f475-4e6d-8d90-3fc9984f40a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63493","advisory_id":"43ac1515-f475-4e6d-8d90-3fc9984f40a2","event_types":["advisory"],"published_at":"2026-10-24T21:34:11.219687+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:37:09.832+00:00","detail_url":"/events/3383"},"members":[{"id":3383,"cve_ids":["CVE-2026-63493"],"payload":{"kind":"advisory","title":"Snipe-IT: 2FA bypass via the API token flow","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0.","evidence":"cve:CVE-2026-63493","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63493","aliases":["CVE-2026-63493"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-29T02:54:32.742Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","https://github.com/grokability/snipe-it/pull/19294","https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e","https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63493","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T02:54:07.180253Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T02:54:32.742Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:37:09.832Z"}}},"related_cves":[{"value":"CVE-2026-63493","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:43ac1515-f475-4e6d-8d90-3fc9984f40a2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63493","advisory_id":"43ac1515-f475-4e6d-8d90-3fc9984f40a2","event_types":["advisory"],"published_at":"2026-10-24T21:34:11.219687+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:37:09.832+00:00","detail_url":"/events/3383"}]}},{"id":3163,"cve_ids":["CVE-2026-63498"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-63498","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63498","aliases":["CVE-2026-63498"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-28T15:39:50.853Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63498","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T15:39:44.519362Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:39:50.853Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:29:57.380Z"}}},"related_cves":[{"value":"CVE-2026-63498","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:99de0c2a-2e56-4969-949a-c2b75fdf805c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63498","advisory_id":"99de0c2a-2e56-4969-949a-c2b75fdf805c","event_types":["advisory"],"published_at":"2026-10-24T21:31:00.69466+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:29:57.38+00:00","detail_url":"/advisories/advisory%3A99de0c2a-2e56-4969-949a-c2b75fdf805c","group":{"id":"advisory:99de0c2a-2e56-4969-949a-c2b75fdf805c","revision":1,"primary_event_id":3173,"change":"published","superseded_by":[],"changed":{"id":3173,"cve_ids":["CVE-2026-63498"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-63498","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63498","aliases":["CVE-2026-63498"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-28T15:39:50.853Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63498","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T15:39:44.519362Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:39:50.853Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:29:57.380Z"}}},"related_cves":[{"value":"CVE-2026-63498","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:99de0c2a-2e56-4969-949a-c2b75fdf805c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63498","advisory_id":"99de0c2a-2e56-4969-949a-c2b75fdf805c","event_types":["advisory"],"published_at":"2026-10-24T21:31:00.69466+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:29:57.38+00:00","detail_url":"/events/3173"},"members":[{"id":3173,"cve_ids":["CVE-2026-63498"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-63498","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-63498","aliases":["CVE-2026-63498"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-28T15:39:50.853Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63498","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T15:39:44.519362Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T15:39:50.853Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:29:57.380Z"}}},"related_cves":[{"value":"CVE-2026-63498","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:99de0c2a-2e56-4969-949a-c2b75fdf805c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63498","advisory_id":"99de0c2a-2e56-4969-949a-c2b75fdf805c","event_types":["advisory"],"published_at":"2026-10-24T21:31:00.69466+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:29:57.38+00:00","detail_url":"/events/3173"}]}},{"id":1815,"cve_ids":["CVE-2026-62368"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-62368","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62368","aliases":["CVE-2026-62368"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-24T17:13:38.717Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62368","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:13:19.981641Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:13:38.717Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:40:34.110Z"}}},"related_cves":[{"value":"CVE-2026-62368","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bd55d86a-0eab-40ca-b164-4946d0ac67fe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62368","advisory_id":"bd55d86a-0eab-40ca-b164-4946d0ac67fe","event_types":["advisory"],"published_at":"2026-10-24T21:08:04.218084+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:40:34.11+00:00","detail_url":"/advisories/advisory%3Abd55d86a-0eab-40ca-b164-4946d0ac67fe","group":{"id":"advisory:bd55d86a-0eab-40ca-b164-4946d0ac67fe","revision":1,"primary_event_id":1803,"change":"published","superseded_by":[],"changed":{"id":1803,"cve_ids":["CVE-2026-62368"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-62368","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62368","aliases":["CVE-2026-62368"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-24T17:13:38.717Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62368","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:13:19.981641Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:13:38.717Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:40:34.110Z"}}},"related_cves":[{"value":"CVE-2026-62368","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bd55d86a-0eab-40ca-b164-4946d0ac67fe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62368","advisory_id":"bd55d86a-0eab-40ca-b164-4946d0ac67fe","event_types":["advisory"],"published_at":"2026-10-24T21:08:04.218084+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:40:34.11+00:00","detail_url":"/events/1803"},"members":[{"id":1803,"cve_ids":["CVE-2026-62368"],"payload":{"kind":"advisory","title":"Snipe-IT: Stored XSS via Custom Field name in asset-list column headers","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0.","evidence":"cve:CVE-2026-62368","products":[{"name":{"value":"snipe-it","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-62368","aliases":["CVE-2026-62368"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"grokability","product":"snipe-it","versions":[{"status":"affected","version":"< 8.7.0"}]}],"modified":"2026-09-24T17:13:38.717Z","provider":"cve","references":["https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","https://github.com/grokability/snipe-it/releases/tag/v8.7.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-62368","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T17:13:19.981641Z"}}}],"references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T17:13:38.717Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-24T16:40:34.110Z"}}},"related_cves":[{"value":"CVE-2026-62368","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:bd55d86a-0eab-40ca-b164-4946d0ac67fe","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-62368","advisory_id":"bd55d86a-0eab-40ca-b164-4946d0ac67fe","event_types":["advisory"],"published_at":"2026-10-24T21:08:04.218084+00:00","technologies":["core-cve","snipe-it"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-24T16:40:34.11+00:00","detail_url":"/events/1803"}]}}],"next_after":45386,"next_before":1815}