Main Vulnerability Database Vulnerabilities #VU145104

Improper access control in snipe-it - CVE-2026-86764

Published: August 25, 2026 / Updated: September 14, 2026

Vulnerability identifier: #VU145104

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-86764

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the GET /api/v1/hardware//assigned/components endpoint when handling requests for assigned component details. A remote user can send a request to enumerate component IDs, names, quantities, and notes to disclose sensitive information.

Direct component API requests correctly enforce the required permission and return forbidden responses, but the affected endpoint checks only the parent asset permission before returning linked component data.

Affected software

snipe-it

How to mitigate CVE-2026-86764

Install security update from vendor's website.

snipe-it - update to 8.7.0

External References

https://github.com/grokability/snipe-it/security/advisories/GHSA-v973-fm42-f8xv

Related Security Bulletins