Medium severity5.0NVD Advisory· Published Sep 9, 2026· Updated Sep 16, 2026
CVE-2026-86767
CVE-2026-86767
Description
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.
Affected products
3<8.7.0+ 1 more
- (no CPE)range: <8.7.0
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*range: <8.7.0
- Range: <8.7.0
Patches
Vulnerability mechanics
References
2- github.com/grokability/snipe-it/security/advisories/GHSA-fxm8-w79r-g7wrnvdExploitVendor Advisory
- www.vulncheck.com/advisories/snipe-it-before-8.7.0-cross-company-read-via-requested-assetsnvdThird Party Advisory
News mentions
1- Snipe-IT: 25 Authorization and Access Control Flaws Disclosed in Single BatchVypr Intelligence · Sep 9, 2026