Missing Authorization in snipe-it - #VU145076
Published: August 25, 2026
Vulnerability identifier: #VU145076
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in app/Http/Controllers/Assets/AssetsController.php::getBarCode when handling GET /hardware/{asset}/barcode requests. A remote user can iterate asset IDs and retrieve barcode PNGs to disclose sensitive information.
The barcode encodes the asset tag, and the response behavior can reveal asset existence and deletion state, including cross-company assets under FMCS.
Affected software
snipe-it
Remediation
Install security update from vendor's website.
snipe-it - update to 8.7.0