Authorization Bypass Vulnerability in Snipe-IT by Grokability

CVE-2026-84206

What is CVE-2026-84206?

A vulnerability in Snipe-IT prior to version 8.7.0 allows attackers with edit permissions to exploit the bulk asset restore endpoint. This endpoint incorrectly restricts access based on assets.edit permissions instead of the more appropriate assets.delete permissions, enabling unauthorized users to restore soft-deleted assets. Consequently, attackers can manipulate asset identifiers to undo deletions carried out by administrators, effectively bypassing crucial permission controls.

References