Authorization Bypass in Snipe-IT Affects Multiple Versions

CVE-2026-86761

What is CVE-2026-86761?

Snipe-IT versions before 8.7.0 are vulnerable to an authorization bypass issue within the location print endpoints. This vulnerability does not enforce necessary per-model authorization checks. As a result, authenticated attackers with location view permissions can exploit this flaw to access sensitive data through the printassigned and printallassigned endpoints. This access allows them to retrieve information about related users, assets, accessories, consumables, and components—bypassing individual model permissions that would normally restrict such actions.

References