CVE-2026-84206 — Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted …
Published: 2026-09-01 · CVSS: 5.3 · CVSS 4.0
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7