Missing Encryption Vulnerability in Snipe-IT Remote Asset Management Software

CVE-2026-116198

What is CVE-2026-116198?

Snipe-IT versions prior to 8.7.0 feature a security flaw that allows authenticated API users, lacking the appropriate permissions, to create assets with sensitive custom-field values stored without encryption. This oversight can lead to sensitive information being retained in plaintext within the database, making it accessible through backups, replicas, or direct database access. Organizations using affected versions should review and mitigate risks associated with this vulnerability to protect sensitive data.

References