CVE-2026-86761
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Sep 8, 2026
Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
snipe-itgrokability |
|
References
- GitHub Security Advisory (GHSA-cg5w-9662-73vx)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpointsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.