Medium severity4.3NVD Advisory· Published Sep 9, 2026· Updated Sep 16, 2026
CVE-2026-86761
CVE-2026-86761
Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
3- github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553anvdPatch
- github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vxnvdExploitVendor Advisory
- www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpointsnvdThird Party Advisory
News mentions
1- Snipe-IT: 25 Authorization and Access Control Flaws Disclosed in Single BatchVypr Intelligence · Sep 9, 2026