Medium severity5.0NVD Advisory· Published Sep 9, 2026· Updated Sep 14, 2026
CVE-2026-86743
CVE-2026-86743
Description
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<8.7.0+ 1 more
- (no CPE)range: <8.7.0
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
2- github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6wnvdExploitVendor AdvisoryMitigationPatch
- www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-asset-acceptance-reportnvdThird Party Advisory
News mentions
0No linked articles in our index yet.