CVE-2026-86761 in Snipe-IT
Summary
by MITRE • 09/09/2026
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The identified security flaw resides within the Snipe-IT asset management platform in versions prior to 8.7.0, specifically targeting the location-based print functionality. This vulnerability represents a critical authorization bypass where the application fails to enforce per-model authorization checks for specific endpoints related to printing assigned items from locations. The core technical issue stems from an insufficient access control mechanism that relies on broader role permissions rather than granular object-level or model-specific validations when processing requests to these particular API routes. Consequently, the system does not verify whether the authenticated user has explicit permission to view or print data for specific asset types such as assets, accessories, consumables, components, or users associated with a given location.
This architectural weakness allows any authenticated user who possesses the general permission to view locations to exploit this gap by directly accessing the printassigned and printallassigned endpoints. By manipulating these requests, an attacker can retrieve sensitive information including details of related users, assets, accessories, consumables, and components associated with that location. This access is granted regardless of whether the individual user has been explicitly denied permission for those specific models or if they lack the necessary privileges to view such data under normal application workflows. The vulnerability effectively bypasses the intended security boundaries established by the role-based access control system within Snipe-IT, leading to a significant degradation in confidentiality and integrity of the managed inventory data.
From an operational perspective, this authorization bypass enables unauthorized information disclosure that can lead to further malicious activities such as social engineering attacks or targeted exploitation of specific hardware vulnerabilities based on exposed asset details. Attackers with low-level privileges are elevated functionally without gaining higher system roles, which complicates detection through standard privilege escalation monitoring tools since the user remains within their nominal role boundaries while accessing restricted data. The impact extends beyond mere data leakage; it undermines trust in the access control framework and exposes organizational assets to potential physical or digital threats based on exposed inventory configurations.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing object-level permissions despite having valid session credentials. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies entirely on legitimate authentication but abuses insufficient authorization logic rather than credential theft or compromise. The attack vector is classified under Remote Code Execution via Web Application Services with Low Complexity requirements for initial access since it requires only valid login credentials and network connectivity to the vulnerable endpoint.
Mitigation strategies must prioritize immediate upgrading of the Snipe-IT instance to version 8.7.0 or later, where these authorization checks have been corrected to enforce strict per-model validation before processing print requests. In environments where patching is not immediately feasible, administrators should implement web application firewall rules that restrict access to the affected endpoints based on IP whitelisting if possible, although this is less effective against authenticated internal threats. Additionally, reviewing and tightening role-based permissions by minimizing location view privileges for users who do not require them can reduce the attack surface. Regular audits of authorization logic in custom modules or plugins integrated with Snipe-IT are recommended to ensure consistent enforcement of access controls across all application features.