CVE-2026-86758 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical authorization bypass within the application's asset management and licensing modules. This flaw specifically targets the enforcement mechanisms governing access control for sensitive license data, namely product keys. The core issue lies in the improper implementation of the viewKeys authorization gate across two distinct interfaces: the CSV export functionality and the API index endpoints. In a properly secured system, these operations should require elevated privileges beyond basic viewing rights to prevent unauthorized exposure of proprietary or licensed software identifiers. However, due to this misconfiguration, authenticated users who possess only the licenses.view permission are able to bypass security checks that were intended to restrict access to license keys. This discrepancy allows individuals with minimal privilege levels to perform actions reserved for administrators or higher-privileged roles, fundamentally undermining the principle of least privilege that underpins modern application security architectures.
From a technical perspective, the vulnerability manifests through two primary attack vectors. First, via the CSV export feature, an attacker can request a bulk download of license data which inadvertently includes product keys in the exported file. This allows for the mass exfiltration of sensitive licensing information without triggering any additional authentication or authorization prompts. Second, the API index endpoint exhibits behavior where response discrepancies can be leveraged to validate specific candidate keys. Even if direct access is restricted, an attacker can perform enumeration attacks by sending requests with varying key parameters and analyzing differences in HTTP status codes or response payloads to determine which keys are valid. This side-channel information leakage effectively neutralizes any partial restrictions that might have been intended for the API layer, turning a simple viewing permission into a powerful tool for reconnaissance and data theft.
The operational impact of this vulnerability is significant for organizations relying on Snipe-IT for license compliance and asset tracking. The unauthorized disclosure of product keys can lead to direct financial losses through software piracy if these keys are distributed illegally by malicious actors or disgruntled employees. Furthermore, the exposure of internal licensing structures may aid attackers in planning further attacks against the organization's IT infrastructure. Knowledge of valid key formats and active licenses provides valuable intelligence for social engineering campaigns or targeted exploits that require specific licensed software to be present on target systems. The ability to bulk export this data exacerbates the risk by allowing rapid, large-scale theft rather than requiring time-consuming individual lookups, thereby increasing the potential damage window significantly.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it allows a user to perform actions that exceed their assigned permissions. It also relates closely to CWE-862, Missing Authorization, because the application fails to enforce access control for specific sensitive data fields within otherwise accessible endpoints. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving Valid Accounts and potentially Data from Information Repositories if used in conjunction with other exploitation steps. The lack of proper enforcement on API responses also touches upon CWE-209, which concerns the generation of error messages containing sensitive information, although here it is more about structural response differences rather than explicit error text leakage.
Mitigation for this vulnerability requires immediate upgrading to Snipe-IT version 8.7.0 or later, where these authorization gates have been corrected to properly enforce viewKeys permissions on both CSV exports and API endpoints. Organizations should also implement strict input validation and output encoding practices across all data export features to ensure that sensitive fields are consistently masked or excluded based on user role. Additionally, implementing robust monitoring for unusual bulk download activities can help detect potential exploitation attempts in real-time. Security teams should review their current access control policies to ensure that the principle of least privilege is strictly applied to all API endpoints and administrative functions, regularly auditing permission assignments to prevent similar authorization bypasses from occurring through other vectors within the application ecosystem.