Medium severity6.5NVD Advisory· Published Sep 9, 2026· Updated Sep 16, 2026
CVE-2026-86758
CVE-2026-86758
Description
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3<8.7.0+ 1 more
- (no CPE)range: <8.7.0
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
2- github.com/grokability/snipe-it/security/advisories/GHSA-5jcj-c9p3-82q7nvdExploitVendor Advisory
- www.vulncheck.com/advisories/snipe-it-before-8.7.0-license-key-exposure-via-csv-exportnvdThird Party Advisory
News mentions
1- Snipe-IT: 25 Authorization and Access Control Flaws Disclosed in Single BatchVypr Intelligence · Sep 9, 2026