Missing Encryption of Sensitive Data in snipe-it - #VU154178
Published: October 13, 2026
Vulnerability details
The vulnerability allows a remote user to write plaintext into custom-field columns designated as encrypted.
The vulnerability exists due to missing encryption of sensitive data in ApiAssetsController::store when processing asset creation requests from callers without the assets.view.encrypted_custom_fields permission. A remote user can submit custom-field values in an asset creation request to write plaintext into custom-field columns designated as encrypted.
This does not bypass confidentiality controls for the writer: readers without assets.view.encrypted_custom_fields still receive the literal string "ENCRYPTED" instead of the field value. The API update path, non-API paths, and BulkAssetsController are not affected by this issue.