CVE-2026-86743 — Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across al…
Published: 2026-09-09 · CVSS: 5.3 · CVSS 4.0
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7