CVE-2026-86743: Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the reports.view permission can exploit it. The user does not need per-row access to the affected asset acceptance records.
What information can be exposed?
The unaccepted_assets report page and its CSV export can reveal pending acceptance records from all companies, including cross-company inventory details and assignee names.
Which deployments are affected?
Snipe-IT versions before 8.7.0 are affected where users have the reports.view permission and the deployment contains multiple companies with pending asset acceptances.
How can I check for exposure?
Review access to the unaccepted_assets report and CSV export for reports.view users. In a multi-company deployment, verify whether such a user can view pending acceptance entries belonging to companies for which they lack per-row access.