Read the docs
TI-2026-59327 Aliases CVE-2026-86770GHSA-vp3x-c2h8-v6w8

Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation

Priority HIGH 72CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00571 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snipe-it (grokability): 8.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
grokabilitysnipe-it8.6.3 to before 8.7.08.7.0Patch availableCNA
  • snipe-it Vendorgrokability Affected 8.6.3 to before 8.7.0 Fixed in 8.7.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*before 8.7.0Vulnerablegrokability
  • cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.7.0 Vulnerable ·grokability

Remediation

  • Fix · CNA snipe-it (grokability) Fixed in 8.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    grokability snipe-it 8.7.0

    33 records Highest priority Priority HIGH 5 HIGH, 8 MEDIUM, 20 LOW

    Other records, highest priority first

    • TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via MarkdownPriority HIGH 70
    • TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAPriority HIGH 70
    • TI-2026-59328 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_numPriority HIGH 69
    Show all 33 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86770
  2. 2026-10-03 Alias added: GHSA-vp3x-c2h8-v6w8

References

Exploit 1

  • TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
  • TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
  • TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
  • TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
  • TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
  • TI-2026-58741 Snipe-IT before 8.6.2 Authorization Bypass via Checkout-Acceptance CVSS 4.0HIGH 8.4
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences