CVE-2026-86761: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Restrict access to the Snipe-IT location print endpoints (/printassigned and /printallassigned) so that only authorized users with the required per-model permissions (and without location view) can reach them, until upgraded to 8.7.0 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with permission to view locations can exploit the affected location print endpoints. The user does not need permission for each individual related model.
What information could an unauthorized user retrieve?
The affected printassigned and printallassigned endpoints can expose related users, assets, accessories, consumables, and components associated with locations.
Which versions are affected?
Snipe-IT versions before 8.7.0 are affected. Upgrading to 8.7.0 or later addresses the vulnerable version range.