CVE-2026-86761

Summary

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.

Affected Software

Weaknesses

• CWE-639: Authorization Bypass Through User-Controlled Key

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx

References

• https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
• https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
• https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints

• ←Previous
• Next→