CVE-2026-86757: Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encryptedcustomfields permission check.
Affected Software
Event History
Frequently Asked Questions
Which users are exposed to this disclosure?
Authenticated users who have any of the assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can access the affected asset forms. They do not need the assets.view.encrypted_custom_fields permission.
What must an attacker do to view the protected values?
The attacker must authenticate with one of the affected asset permissions and open an asset form containing an encrypted custom field. The issue affects listbox, textarea, markdown-textarea, and date/datetime picker custom-field elements.
Are encrypted custom fields exposed as ciphertext or plaintext?
Affected encrypted custom-field values are disclosed in plaintext when the relevant asset forms are opened.
How can I determine whether my deployment is affected?
Deployments running Snipe-IT before 8.7.0 are affected. Review whether users assigned assets.edit, assets.checkin, assets.checkout, or assets.audit can open asset forms containing encrypted custom fields of the affected element types.