Missing Authorization in snipe-it - CVE-2026-86737
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU145076
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86737
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in app/Http/Controllers/Assets/AssetsController.php::getBarCode when handling GET /hardware/{asset}/barcode requests. A remote user can iterate asset IDs and retrieve barcode PNGs to disclose sensitive information.
The barcode encodes the asset tag, and the response behavior can reveal asset existence and deletion state, including cross-company assets under FMCS.
Affected software
snipe-it
How to mitigate CVE-2026-86737
Install security update from vendor's website.
snipe-it - update to 8.7.0