CVE-2026-116198
Received Received - Intake

Snipe-IT Missing Encryption in Custom Field Storage

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116198
EUVD
EUVD-2026-109456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grokability snipe-it 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-311 The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Snipe-IT before version 8.7.0 has a vulnerability where sensitive custom-field values are stored unencrypted in the database when created via the API by users lacking the assets.view.encrypted_custom_fields permission. The system is designed to encrypt these fields, but the encryption logic fails to trigger, causing plaintext data to persist in encrypted-flagged columns.

Detection Guidance

Check Snipe-IT version with 'php artisan version' or inspect the database for unencrypted sensitive custom-field values in assets tables. Review API logs for users creating assets without proper permissions.

Impact Analysis

Unauthorized users with API access but without the required permission could expose sensitive asset data through database backups, replicas, or direct queries. This risks data breaches, loss of confidentiality, and potential compliance violations depending on the nature of the stored information.

Compliance Impact

This vulnerability violates encryption-at-rest requirements under GDPR and HIPAA, as sensitive data is stored in plaintext despite being marked for encryption. Organizations using affected versions may face non-compliance penalties, audit failures, and increased exposure to data protection violations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Review and remove any unencrypted sensitive data from custom fields. Audit API user permissions to ensure only authorized users can create assets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart