CVE-2026-86767 — Snipe-IT before 8.7.0 Cross-Company Read via requested-assets
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticate…
Published: 2026-09-09 · CVSS: 5.3 · CVSS 4.0
Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7