Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. This exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. Version 8.6.1 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 Snipe-IT, Authorization Bypass, #CVE-2026-48492 (Medium) -DC-Jul2026-889 https://dailycve.com/snipe-it-authorization-bypass-cve-2026-48492-medium-dc-jul2026-889/
Post summary
The post is a straightforward disclosure of the CVE‑2026‑48492 authorization bypass in Snipe‑IT with basic technical details but no evidence of exploitation, PoC, or mitigation information.
🔵 Snipe-IT Improper Access Control Vulnerability #CVE-2026-48492 (Low) -DC-Jun2026-614 https://dailycve.com/snipe-it-improper-access-control-vulnerability-cve-2026-48492-low-dc-jun2026-614/
Post summary
The post announces CVE-2026-48492, an improper access control flaw in Snipe-IT, but provides no further exploit details, patch information, or technical depth.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |