CVE-2026-86743 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical failure in multi-tenant data isolation, specifically within the asset acceptance reporting functionality. This flaw allows authenticated users with the reports.view permission to bypass intended organizational boundaries and retrieve sensitive inventory information belonging to other companies within the same instance. The core technical issue stems from insufficient scoping of database queries associated with the pending acceptances report. When a user requests this data, either through the web interface or via CSV export, the application fails to filter results based on the requesting user's assigned company context. Consequently, the query returns all unaccepted assets across every organization hosted by the Snipe-IT instance, rather than restricting output to only those assets associated with the current tenant. This lack of per-row access validation means that even if a user does not have direct permission to view specific asset details in other contexts, they can still extract this information through the aggregated report endpoint.
From an operational perspective, this vulnerability enables unauthorized disclosure of cross-company inventory details and assignee names. Attackers who compromise or possess valid credentials for any account with reports.view privileges can exploit this flaw to map out the entire IT infrastructure landscape across all organizations managed by the platform. This includes identifying hardware models, serial numbers, purchase dates, and crucially, the identities of individuals assigned to these assets. Such information is highly valuable for social engineering attacks or further reconnaissance efforts within a multi-tenant environment where data segregation is paramount. The ability to export this data as CSV files exacerbates the risk by allowing attackers to easily process and analyze large volumes of sensitive corporate intelligence without triggering immediate alerts associated with individual record access attempts.
This vulnerability aligns closely with CWE-284, Improper Access Control, specifically reflecting a failure in enforcing scope restrictions for authenticated users. It also maps to MITRE ATT&CK technique T1005, Data from Local System, as it involves the exfiltration of data through legitimate application features that are misconfigured or poorly secured against cross-tenant leakage. In multi-tenant SaaS applications and enterprise asset management systems, maintaining strict logical separation between tenants is a fundamental security requirement. The absence of this control undermines the trust model upon which such platforms operate, potentially violating compliance requirements related to data privacy and segregation in regulated industries.
To mitigate this vulnerability, organizations running Snipe-IT must immediately upgrade to version 8.7.0 or later, where the developers have implemented proper scoping mechanisms for asset acceptance report queries. Until an upgrade is feasible, administrators should consider restricting the reports.view permission to only those users who strictly require it and are part of a single company context if possible. Additionally, implementing network-level controls such as web application firewalls may help detect anomalous bulk data extraction patterns, although this is not a substitute for fixing the underlying code flaw. Regular audits of user permissions and review of access control logic in custom reports or extensions are also recommended to ensure that no other endpoints suffer from similar scoping deficiencies.