CVE-2026-86758

Undergoing Analysis Undergoing Analysis - In Progress

Sensitive Data Exposure in Snipe-IT via License Key Disclosure

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86758

EUVD

EUVD-2026-74935

Affected Vendors & Products

Vendor	Product	Version / Range
snipe-it	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	to 8.6.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-204	The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Snipe-IT before version 8.7.0 has a flaw where the viewKeys authorization gate is not properly enforced. This allows authenticated users with only licenses.view permission to access product keys. Attackers can exploit this by downloading all license keys via CSV export or validating candidate keys through API response discrepancies without needing the viewKeys permission.

Detection Guidance

To detect this vulnerability, check if unauthorized users can access license keys via CSV export or API endpoints. Monitor for bulk CSV downloads from /licenses/export and test API responses for /api/v1/licenses to see if product key existence is revealed without viewKeys permission.

Impact Analysis

This vulnerability can lead to exposure of sensitive license keys, potentially causing financial loss due to relicensing or vendor audits. If product keys double as activation credentials, unauthorized use of licensed software may occur. Attackers could validate candidate keys by observing API response differences.

Compliance Impact

This vulnerability exposes license keys which may contain sensitive data. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized access to license keys could lead to non-compliance with these regulations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later. Temporarily restrict licenses.view permission to trusted users only. Block access to /licenses/export and sensitive API query parameters at the web server or WAF level until patched.

Hi! I’m here to help you understand CVE-2026-86758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70