CVE-2026-116198: Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Q: Which users can exploit this issue?

Authenticated API users who do not have the assets.view.encrypted_custom_fields permission can exploit it by creating assets with values in encrypted custom fields.

Q: What conditions are required for exposure?

The affected custom fields must be marked for encryption, and a user must create an asset through Api\AssetsController::store. The resulting values are stored in plaintext and may be exposed to parties with access to database backups, replicas, or the database itself.

Q: Are existing encrypted custom-field values affected?

The available information identifies asset creation through the API endpoint as the affected operation. It does not state that previously stored values are converted to plaintext or otherwise affected.

Q: What version should be used to remediate the issue?

Upgrade Snipe-IT to version 8.7.0 or later. The issue affects versions before 8.7.0.

Published Oct 25, 2026

Updated

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

Affected Software

1 affected component

Snipe-IT Snipe-IT<8.7.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Authenticated API users who do not have the assets.view.encrypted_custom_fields permission can exploit it by creating assets with values in encrypted custom fields.

What conditions are required for exposure?

The affected custom fields must be marked for encryption, and a user must create an asset through Api\AssetsController::store. The resulting values are stored in plaintext and may be exposed to parties with access to database backups, replicas, or the database itself.

Are existing encrypted custom-field values affected?

The available information identifies asset creation through the API endpoint as the affected operation. It does not state that previously stored values are converted to plaintext or otherwise affected.

What version should be used to remediate the issue?

Upgrade Snipe-IT to version 8.7.0 or later. The issue affects versions before 8.7.0.

CVE-2026-116198: Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What conditions are required for exposure?

Are existing encrypted custom-field values affected?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What conditions are required for exposure?

Are existing encrypted custom-field values affected?

What version should be used to remediate the issue?