Snipe-IT Asset Audit Authorization Bypass

Executive Summary

CVE-2026-86752 is an authorization bypass flaw in Snipe-IT versions before 8.7.0. The vulnerability occurs because asset audit endpoints fail to enforce per-instance FMCS scoping at the policy layer, relying only on query-layer filtering. This means attackers with valid sessions and assets.audit permissions could write audit log entries for assets belonging to other companies if the query-layer scope were bypassed or altered.

The issue stems from three endpoints using a class-level authorization check instead of a per-instance check, allowing the policy layer to ignore the target asset and bypass FMCS restrictions.

Useful 0 Not Useful 0

Detection Guidance

Check Snipe-IT version with: grep '"version"' /path/to/snipe-it/composer.json. If version is below 8.7.0, the system is vulnerable. Review audit logs for unexpected entries from users without cross-company permissions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to write audit log entries for assets they should not have access to, potentially leading to data leaks or compliance violations. Attackers could manipulate audit logs to hide unauthorized activities or frame other users for actions they did not perform.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise compliance with GDPR and HIPAA by allowing unauthorized access to audit logs and asset data. GDPR requires strict data access controls and audit trails, while HIPAA mandates secure handling of sensitive health information. Unauthorized modifications to audit logs could violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Verify per-instance FMCS enforcement in audit endpoints by testing access to cross-company assets with valid permissions.

Useful 0 Not Useful 0