CVE-2026-86737 in Snipe-IT
Summary
by MITRE • 09/08/2026
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical failure in access control mechanisms within the application's API layer. Specifically, the GET /hardware/{asset}/barcode endpoint lacks proper authorization checks when processing requests for asset barcode data. This flaw allows authenticated users who possess valid credentials but lack explicit permissions to view specific assets to bypass intended restrictions. The core technical issue lies in the absence of a verification step that ensures the requesting user has ownership or administrative rights over the particular asset ID being queried, leading to an insecure direct object reference scenario where resource access is determined solely by the predictability and sequential nature of identifiers rather than strict permission enforcement.
From an operational perspective, this vulnerability enables attackers to perform systematic enumeration attacks against the application's database. By iterating through a range of integer-based asset IDs, an attacker can retrieve barcode information for assets they are not authorized to view. This capability extends beyond standard active records, as it also includes soft-deleted assets and resources belonging to other tenants in multi-tenant deployments. The exposure of barcodes often correlates with the disclosure of internal asset tags, serial numbers, or inventory identifiers that may contain sensitive organizational data such as hardware specifications, deployment locations, or procurement details. In a SaaS environment where multiple organizations share infrastructure, this cross-company leakage poses severe privacy and compliance risks, potentially violating data isolation requirements mandated by standards like ISO 27001 or GDPR.
The classification of this vulnerability aligns with CWE-862, which denotes Missing Authorization, as the application fails to enforce proper access controls on a protected resource. Furthermore, it maps directly to MITRE ATT&CK technique T1049, System Network Discovery, specifically under the sub-category of Service Scan or Enumeration methods used by adversaries to map out an organization's IT infrastructure and identify valuable targets for further exploitation. The ability to enumerate assets across tenants also touches upon CWE-284, Improper Access Control, highlighting a fundamental breakdown in tenant isolation logic within the multi-tenancy architecture.
To mitigate this risk, organizations running Snipe-IT must immediately upgrade to version 8.7.0 or later, where the developers have implemented strict authorization checks on the barcode endpoint to ensure that only users with appropriate permissions can access asset-specific data. For environments unable to patch immediately due to compatibility constraints, network-level controls such as Web Application Firewalls should be configured to detect and block rapid sequential requests targeting different asset IDs from a single source IP address. Additionally, implementing rate limiting on API endpoints can significantly reduce the feasibility of enumeration attacks by introducing delays that make iterative scanning impractical for attackers while maintaining acceptable performance for legitimate users.