CVE-2026-86767: Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
If Full Multiple Company Support is enabled, restrict access to the /hardware/requested endpoint (or otherwise limit assets.view permission) to prevent authenticated users from viewing pending asset requests across companies until upgrading to Snipe-IT 8.7.0.
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
Snipe-IT deployments running versions before 8.7.0 are affected when Full Multiple Company Support is enabled. The exposed data is pending asset requests across company boundaries.
What access does an attacker need to exploit it?
An attacker needs an authenticated Snipe-IT account with the assets.view permission. No user interaction or parameter manipulation is required.
What information can be disclosed?
The endpoint can reveal requested asset names, requester display names and profile links, locations, and expected check-in dates for pending requests belonging to other companies.
How can administrators determine whether they may be exposed?
Verify whether the deployment is running a version before 8.7.0 and whether Full Multiple Company Support is enabled. In that configuration, users with assets.view permission can access GET /hardware/requested and may be able to view cross-company pending requests.