How many CVEs have patched store?

15 published CVEs changed store in grokability/snipe-it, in 29 distinct patches totalling 576 changed lines, between 2025 and 2026.

What is the latest CVE that changed store?

CVE-2026-86766 (Snipe-IT 8.6.3 Race Condition via Consumable Checkout), published 2026-09-09, changed lines 86 to 120 of app/Http/Controllers/Accessories/AccessoryCheckoutController.php.

How does store compare to the rest of grokability/snipe-it?

grokability/snipe-it has 53 CVEs with a located fix in total; 15 of them changed store.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

store in grokability/snipe-it: Patched by 15 CVEs

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Accessories/AccessoryCheckoutController.php · lines 86–120 · +33 −10

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Components/ComponentCheckoutController.php · lines 117–150 · +34 −10

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Race Condition via Consumable Checkout

CVE-2026-86766 · app/Http/Controllers/Consumables/ConsumableCheckoutController.php · lines 111–146 · +34 −9

High · CVSS 7.1

EPSS 0.3%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Accessories/AccessoryCheckoutController.php · lines 86–120 · +33 −10

High · CVSS 7.1

EPSS 0.4%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Components/ComponentCheckoutController.php · lines 117–150 · +34 −10

High · CVSS 7.1

EPSS 0.4%2026-09-09

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

CVE-2026-86765 · app/Http/Controllers/Consumables/ConsumableCheckoutController.php · lines 111–146 · +34 −9

High · CVSS 7.1

EPSS 0.4%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Accessories/AccessoryCheckoutController.php · lines 86–120 · +33 −10

Low · CVSS 2.1

EPSS 0.3%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Components/ComponentCheckoutController.php · lines 117–150 · +34 −10

Low · CVSS 2.1

EPSS 0.3%2026-09-09

snipe-it before 8.7.0 Race Condition in Asset Checkout

CVE-2026-86744 · app/Http/Controllers/Consumables/ConsumableCheckoutController.php · lines 111–146 · +34 −9

Low · CVSS 2.1

EPSS 0.3%2026-09-09

Snipe-IT before 8.7.1 Denial of Service via Unbounded Note Field

CVE-2026-86734 · app/Http/Controllers/Account/AcceptanceController.php · lines 101–108 · +8 −0

High · CVSS 7.1

EPSS 0.5%2026-09-08

Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation

CVE-2026-55483 · app/Http/Controllers/Users/UsersController.php · line 167 · +1 −1

Medium · CVSS 4.9

EPSS 0.4%2026-08-19

Snipe-IT: TOTP Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

CVE-2026-49870 · app/Http/Controllers/Licenses/LicenseCheckoutController.php · lines 98–123 · +14 −6

Medium · CVSS 5.9

EPSS 0.4%2026-08-19

Snipe-IT: User Account Escalation via CSV Import

CVE-2026-49976 · app/Http/Controllers/Licenses/LicenseCheckoutController.php · lines 98–123 · +14 −6

Medium · CVSS 6.5

EPSS 0.5%2026-08-19

Snipe-IT: Import created_by can be overwritten

CVE-2026-55475 · app/Http/Controllers/Licenses/LicenseCheckoutController.php · lines 98–123 · +14 −6

Medium · CVSS 5.7

EPSS 0.3%2026-07-10

Snipe-IT: Incorrect permission for legacy license checkin API

CVE-2026-55479 · app/Http/Controllers/Licenses/LicenseCheckinController.php · line 73 · +1 −1

Medium · CVSS 5.3

EPSS 0.3%2026-07-10

Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

CVE-2026-55472 · app/Http/Controllers/Api/LocationsController.php · line 219 · +1 −1

Medium · CVSS 4.3

EPSS 0.3%2026-07-10

Snipe-IT: Directory traversal in displaySig

CVE-2026-55474 · app/Http/Controllers/Account/AcceptanceController.php · line 185 · +1 −1

High · CVSS 7.1

EPSS 0.5%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Accessories/AccessoryCheckoutController.php · lines 80–90 · +11 −1

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/AccessoriesController.php · line 159 · +1 −0

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/ComponentsController.php · line 169 · +1 −0

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/ConsumablesController.php · line 158 · +1 −0

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/DepartmentsController.php · line 115 · +1 −0

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/LicensesController.php · line 183 · +1 −0

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Api/LocationsController.php · lines 214–226 · +11 −4

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Assets/AssetCheckoutController.php · lines 121–132 · +12 −12

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Components/ComponentCheckoutController.php · lines 106–111 · +6 −2

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Consumables/ConsumableCheckoutController.php · lines 105–109 · +5 −1

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/Licenses/LicenseCheckoutController.php · lines 102–116 · +12 −4

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

CVE-2026-54329 · app/Http/Controllers/LocationsController.php · lines 92–109 · +12 −7

High · CVSS 8.5

EPSS 0.4%2026-07-10

Snipe-IT: Privilege Escalation via API Permissions Assignment

CVE-2026-44832 · app/Http/Controllers/Api/UsersController.php · line 465 · +1 −1

High · CVSS 8.7

EPSS 0.4%2026-05-26

Snipe-IT has insecure permissions in file uploads

CVE-2026-37709 · app/Http/Controllers/Api/UploadedFilesController.php · line 96 · +1 −1

Critical · CVSS 9.8

EPSS 0.8%2026-05-07

Grokability Snipe-IT has incorrect authorization for accessing asset information

CVE-2025-47226 · app/Http/Controllers/LocationsController.php · line 69 · +1 −0

Medium · CVSS 5.0

EPSS 1.3%2025-05-02

store

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track grokability/snipe-it CVEs