CVE-2026-86761
Received
Received - Intake
Snipe-IT Authorization Bypass via Print Endpoints
Vulnerability report for CVE-2026-86761, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-09
Last updated on: 2026-09-09
Assigner: VulnCheck
Description
Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| snipe-it | snipe-it | to 8.7.0 (exc) |
| grokability | snipe-it | to 8.7.0 (exc) |
| grokability | snipe-it | From 8.6.3 (inc) to 8.6.99 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
