CVE Alert: CVE-2026-86770 – grokability – snipe

Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowing attackers to authenticate as different users by registering IdP accounts with accent or case variants of victim usernames. Attackers can exploit the default utf8mb4_unicode_ci database collation to bypass username matching and achieve account takeover through federated login paths including SAML, LDAP, and OAuth.

**Risk verdict:** High risk for exposed federated deployments, requiring expedited remediation, although KEV, SSVC exploitation status, EPSS and PoC availability are not provided.

**Why this matters:** Successful abuse can turn a low-privilege or newly created identity into another user’s account, exposing inventory, procurement, support and administrative data. Attackers may target privileged operators to alter asset records, harvest credentials or use the application as a foothold for broader identity compromise; direct availability impact appears limited.

**Most likely attack path:** The path is network-reachable (AV:N), low complexity with no special conditions (AC:L/AT:N), requires only limited privileges (PR:L), and needs no victim interaction (UI:N). Exploitation is therefore most plausible through an enabled SAML, LDAP or OAuth login flow by creating a look-alike identity; scope is unchanged, so lateral movement is not automatic but stolen privileged access could enable access to connected systems.

**Who is most exposed:** Organisations running Snipe-IT on the internet or behind broadly accessible SSO portals, particularly with self-service IdP account creation or synchronisation, face the greatest exposure. Shared service-desk environments and deployments granting administrators extensive inventory permissions warrant priority review.

IdP and application logs for near-duplicate usernames, accent variants and unusual account-linking events.

Correlate successful logins with recently created or changed federated identities.

Alert on new privileged sessions from unfamiliar locations, devices or ASN ranges.

Review asset, user and permission changes following anomalous authentication.

Mitigation and prioritisation:

Upgrade promptly to the first fixed release; treat as an emergency change where federated login is enabled.

Temporarily disable affected federation paths or restrict IdP provisioning and account creation.

Enforce canonical username matching and prevent ambiguous aliases at the identity provider.

Rotate sessions and investigate privileged accounts after upgrading; validate SAML, LDAP and OAuth regression behaviour.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.