CVE-2026-86758
Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- State
- Published
- Severity
- 7.1 High
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 8, 2026
Description
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-204 Observable Response Discrepancy
Affected Products
| Product | Versions |
|---|---|
snipe-itgrokability |
|
References
- GitHub Security Advisory (GHSA-5jcj-c9p3-82q7)vendor-advisory
- VulnCheck Advisory: Snipe-IT before 8.7.0 License Key Exposure via CSV Exportthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.