CVE-2026-86737

Analyzed Analyzed - Analysis Complete

Snipe-IT Asset Barcode Enumeration via Unauthorized Access

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86737

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects snipe-it versions before 8.7.0. The GET /hardware/{asset}/barcode endpoint fails to enforce proper authorization checks. Authenticated attackers can iterate through asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.

Detection Guidance

To detect this vulnerability, check if your Snipe-IT instance is running a version before 8.7.0. You can verify the version by running: curl -s https://your-snipe-it-domain.com | grep -i version. If the version is below 8.7.0, the system is vulnerable.

Impact Analysis

An attacker could enumerate asset tags and retrieve barcodes for all assets, including those that are soft-deleted or belong to other companies. This exposes sensitive asset information and allows probing for asset existence and deletion status.

Mitigation Strategies

Immediately upgrade Snipe-IT to version 8.7.0 or later to fix the missing authorization issue. Ensure proper authorization checks are enforced in the barcode endpoint.

Hi! I’m here to help you understand CVE-2026-86737. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70