Multiple Authorization Bypass Vulnerabilities in Snipe-IT 8.7.0

Three critical authorization bypass vulnerabilities have been identified in Snipe-IT versions prior to 8.7.0. The vulnerabilities allow unauthorized access via OAuth clients, API user creation and updates, and asset history CSV imports. Organizations using affected versions are at risk of unauthorized data manipulation and access. The vulnerabilities have been reported by multiple sources on the same day, indicating a significant threat landscape. No specific CVEs have been assigned yet, but the vulnerabilities are severe enough to warrant immediate attention. Users are advised to upgrade to version 8.7.0 or later to mitigate these risks. The current status of exploitation in the wild is unknown, but the potential impact is substantial. Administrators should prioritize patching to prevent possible breaches.

Key Points: • Three critical authorization bypass vulnerabilities found in Snipe-IT before version 8.7.0. • Vulnerabilities allow unauthorized access through OAuth clients and API user updates. • Immediate upgrade to version 8.7.0 is recommended to mitigate risks.