PT-2026-38544 · Grokability · Snipe-It

0Xaspros · Published 2026-05-07 · Updated 2026-05-12 · CVE-2026-37709

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions grokability snipe-it versions prior to 8.4.1

Description Insecure permissions allow a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component. Users with permissions to view assets or consumables can send a POST request to the "/api/v1/{object type}/{id}/files" endpoint. The API incorrectly authorizes these requests using view permissions instead of write permissions, allowing the persistence of files and audit log entries.

Recommendations Update to version 8.4.1.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-37709

GHSA-XG82-2HRV-HF64

Affected Products

Snipe-It

References · 7

• https://github.com/grokability/snipe-it/commit/676a9958895a77de340565e7a0b17ae744664904 · Patch
• https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xg82-2hrv-hf64 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-37709 · Security Note
• https://github.com/grokability/snipe-it · Note
• https://twitter.com/lyrie_ai/status/2054133649210020128 · Twitter Post
• https://twitter.com/UpwindMDR/status/2053368781305418081 · Twitter Post