Authorization Bypass in Snipe-IT by Grokability

CVE-2026-86743

What is CVE-2026-86743?

Snipe-IT versions prior to 8.7.0 are vulnerable to an authorization bypass issue, where authenticated users with reports.view permissions can access company-specific asset acceptance reports. This flaw grants attackers the ability to view pending acceptance details and other sensitive information across all companies, without the necessary per-row access validation. By exploiting this weakness, attackers can generate unaccepted asset reports and CSV exports, potentially exposing critical cross-company inventory information and assignee details.

References