CVE-2026-86737: snipe-it before 8.7.0 Missing Authorization via barcode endpoint
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
As a compensating control until upgraded, restrict or firewall access to the GET /hardware/{asset}/barcode endpoint so authenticated users cannot access barcodes for assets they are not authorized to view across tenants (including soft-deleted and cross-company assets).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Snipe-IT user who can send requests to the application can exploit the affected barcode endpoint. The attacker does not need elevated privileges or user interaction.
What information can be exposed?
An attacker can iterate asset IDs through the barcode endpoint to retrieve barcodes and enumerate asset tags. The exposure can include assets belonging to other companies or tenants and assets that have been soft-deleted.
Are installations running version 8.7.0 affected?
No. The issue is reported in Snipe-IT versions before 8.7.0.
How can I check for attempted exploitation?
Review application or web-server logs for authenticated requests to GET /hardware/{asset}/barcode, especially repeated requests using sequential or numerous asset IDs. Requests for IDs associated with another company or soft-deleted assets are particularly suspicious.