CVE-2026-86767

Undergoing Analysis Undergoing Analysis - In Progress

Snipe-IT Cross-Tenant Data Exposure via Unfiltered Asset Requests

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86767

EUVD

EUVD-2026-74944

Affected Vendors & Products

Vendor	Product	Version / Range
snipe-it	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	From 8.6.3 (inc) to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-86767 is a vulnerability in Snipe-IT versions before 8.7.0 where company scope filtering is not applied to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. This allows authenticated users with assets.view permission to read pending asset requests from all companies, not just their own.

Detection Guidance

To detect this vulnerability, check if your Snipe-IT instance is running a version before 8.7.0 with Full Multiple Company Support enabled. Verify if authenticated users with assets.view permission can access the GET /hardware/requested endpoint and retrieve cross-company data. Review server logs for unusual requests to this endpoint from users without proper authorization.

Impact Analysis

An attacker with assets.view permission could access sensitive data across all companies, including asset names, requester names, locations, and expected check-in dates. This could lead to unauthorized information disclosure and potential misuse of data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized cross-company data access violates these requirements.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later to apply the fix for company scope filtering.
If upgrading is not immediately possible, revoke the assets.view permission from users who do not require cross-company access.
Temporarily block access to the GET /hardware/requested endpoint until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-86767. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70