Description

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-09T14:17:25.593Z",
  "pubdate": "2026-09-09T14:17:25.593Z",
  "executiveSummary": "This vulnerability involves a critical broken access control flaw within the POST /hardware/history endpoint of Snipe-IT, affecting all versions prior to 8.7.0.\nThe vulnerability allows any authenticated user to perform unauthorized actions, specifically reassigning arbitrary hardware assets across disparate companies and injecting fraudulent audit logs.\nBy bypassing authorization checks, an attacker can manipulate inventory records, effectively subverting organizational accountability and asset management integrity.\nThe attack requires a valid user session, but does not necessitate administrative privileges, making it a significant risk to internal security posture.\nThe primary impact is the loss of data integrity within the asset management system, potentially facilitating internal fraud or masking the unauthorized relocation of physical infrastructure.\nImmediate remediation is required by upgrading to version 8.7.0 or later to ensure proper authorization enforcement on asset modification endpoints.",
  "technicalDetails": "The vulnerability resides in the backend request handling logic for the POST /hardware/history endpoint within Snipe-IT. The application fails to perform sufficient server-side authorization checks to verify if the authenticated user possesses the appropriate permissions or cross-company authorization to modify asset history.\nRoot Cause Analysis: The underlying flaw is an Insecure Direct Object Reference (IDOR) and a lack of access control enforcement at the controller level. When a request is submitted to the endpoint, the application processes the provided data—specifically CSV-formatted payloads—without validating whether the requesting user is authorized to perform historical updates on the target asset ID.\nExploitation Method: An attacker with valid low-privileged credentials can craft a malicious request targeting the /hardware/history endpoint. By submitting a specially formatted CSV file, the attacker can manipulate the asset history records. The application parses this input and executes the state change directly against the database.\nAttack Flow: 1. Authentication: The attacker authenticates to the Snipe-IT instance with a standard user account. 2. Request Crafting: The attacker prepares a CSV file containing instructions to reassign assets to different locations or entities, or to inject false maintenance/audit trail entries. 3. Exploitation: The attacker transmits the CSV via a POST request to the /hardware/history endpoint. 4. Execution: Because the endpoint lacks server-side authorization checks, the application processes the CSV, updating the database entries for the specified assets, effectively performing unauthorized reassignment and log injection.\nImpact: Successful exploitation results in complete loss of asset inventory integrity. Because the audit trail can be falsified, attackers can perform unauthorized asset reassignments that leave no legitimate forensic trace, or they can mask the movement of high-value equipment. This compromises the organization's accountability, compliance, and asset visibility, potentially allowing for the undetected theft or misallocation of organizational hardware."
}