Access Control Issue in Snipe-IT Leading to Information Disclosure

CVE-2026-86757

What is CVE-2026-86757?

Snipe-IT versions prior to 8.7.0 are susceptible to an access control vulnerability that compromises the integrity of encrypted custom-field values. Authenticated users possessing specific permissions, such as assets.edit or assets.audit, can access plaintext versions of encrypted custom fields by simply opening the asset forms. This vulnerability allows them to bypass the necessary permissions intended to secure sensitive information, resulting in unauthorized data exposure.

References