Authorization Bypass Vulnerability in Snipe-IT by Grokability

CVE-2026-86752

What is CVE-2026-86752?

Versions of Snipe-IT prior to 8.7.0 exhibit a significant shortcoming in their asset audit endpoints, where they do not adequately enforce per-instance FMCS (Field Management and Control Systems) scoping. This flaw allows attackers possessing valid session credentials and assets.audit permissions to potentially manipulate audit log entries concerning assets from other companies. The vulnerability arises from the system's dependence on query-layer filtering alone, which can be circumvented, leading to unauthorized access and data manipulation.

References