CVE-2026-84206: Snipe-IT Authorization Bypass Vulnerability

CVE-2026-84206 Overview

CVE-2026-84206 is an authorization bypass vulnerability [CWE-863] in Snipe-IT, an open-source IT asset management application. Versions before 8.7.0 gate the bulk asset restore endpoint on the assets.edit permission instead of assets.delete. Users with only edit rights can therefore restore soft-deleted assets and undo administrator deletions. This breaks the intended permission separation between edit and delete operations. The flaw resides in BulkAssetsController::restore(), which called authorize('update', Asset::class) when it should have enforced the delete policy.

Critical Impact
Authenticated users holding only assets.edit permissions can POST asset identifiers to the bulk restore endpoint and reinstate assets that administrators soft-deleted, bypassing role-based access controls.

Affected Products

Snipe-IT versions prior to 8.7.0
Snipe-IT v8.6.3 (confirmed vulnerable via source reference)
Grokability Snipe-IT self-hosted deployments

Discovery Timeline

2026-09-01 - CVE-2026-84206 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84206

Vulnerability Analysis

Snipe-IT enforces role-based access controls that separate the ability to edit assets from the ability to delete them. The bulk restore action reverses a soft delete and should therefore require delete-tier authorization. In app/Http/Controllers/Assets/BulkAssetsController.php, the restore() method invoked authorize('update', Asset::class), aligning the gate with assets.edit instead of assets.delete.

An authenticated user with only edit privileges can submit a POST request containing an ids array of soft-deleted asset identifiers. The controller iterates the payload, loads each record with Asset::withTrashed(), and calls ->restore() on the model. This reverses administrator deletions without invoking any additional check.

The issue is a broken access control flaw rather than a memory or injection vulnerability. Exploitation requires network access to the application and valid credentials with the assets.edit permission.

Root Cause

The policy gate on the bulk restore handler was mismatched with the semantic meaning of the operation. Restore is a delete-tier action across the Snipe-IT codebase, but the endpoint authorized against the update policy. The mismatch allowed permission boundary crossing.

Attack Vector

An attacker with valid Snipe-IT credentials and the assets.edit role sends a crafted POST request to the bulk restore route with a list of soft-deleted asset IDs. The server restores the records and returns a success redirect. Prior to the patch, the handler also failed to validate the existence of each ID and could throw a 500 error on the first invalid entry.

php

 public function restore(Request $request): RedirectResponse
 {
-    $this->authorize('update', Asset::class);
+    // Restore is a delete-level action across the codebase. The bulk
+    // POST handler used to gate on authorize('update', Asset::class),
+    // letting an assets.edit user undo an admin's soft-delete.
+    $this->authorize('delete', Asset::class);
     $assetIds = $request->input('ids');

     if (empty($assetIds)) {
         return redirect()->route('hardware.index')->with('error', trans('admin/hardware/message.restore.nothing_updated'));
-    } else {
-        foreach ($assetIds as $key => $assetId) {
-            $asset = Asset::withTrashed()->find($assetId);
+    }
+
+    foreach ($assetIds as $assetId) {
+        // Skip invalid or forged IDs. Prior code called ->restore() on
+        // null and 500'd on the first bad id in the payload.
+        if ($asset = Asset::withTrashed()->find($assetId)) {
             $asset->restore();
         }
-        return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.restore.success'));
     }
+
+    return redirect()->route('hardware.index')->with('success', trans('admin/hardware/message.restore.success'));
 }

Source: GitHub Commit 686329001aa457f716b269600659839a58895fee. This patch replaces the update policy check with a delete policy check and adds a null-safety guard on invalid IDs.

Detection Methods for CVE-2026-84206

Indicators of Compromise

POST requests to the bulk asset restore route originating from user accounts that hold only the assets.edit permission.
Unexpected transitions in the assets table where deleted_at changes from a timestamp back to NULL outside of administrator workflows.
Audit log entries showing asset restore actions attributed to non-admin users.

Detection Strategies

Correlate Snipe-IT application logs with role assignments to flag restore actions taken by users lacking assets.delete.
Monitor database change streams on the assets table for deleted_at reversals and match them against the acting user's role.
Review web server access logs for POST requests to the bulk restore endpoint and compare against expected administrator source IPs.

Monitoring Recommendations

Enable Snipe-IT activity logging and forward events to a centralized log platform for retention and query.
Alert on any restore of soft-deleted assets performed by accounts outside the administrator group.
Baseline normal bulk operation volume and alert on anomalous spikes in restore activity.

How to Mitigate CVE-2026-84206

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which enforces the delete policy on the bulk restore handler.
Audit user role assignments and remove the assets.edit permission from accounts that do not require it.
Review recent restore events in application logs to identify unauthorized reversals of soft-deleted assets.

Patch Information

The fix is included in Snipe-IT Release v8.7.0. The relevant change is applied in commit 68632900 to app/Http/Controllers/Assets/BulkAssetsController.php. Additional context is available in the GitHub Security Advisory GHSA-m863-2j99-jxwm and the VulnCheck Advisory.

Workarounds

Restrict access to the bulk restore route at the reverse proxy or web server layer to trusted administrator source addresses until the upgrade is applied.
Temporarily revoke the assets.edit permission from non-administrator roles if immediate patching is not feasible.
Apply the upstream patch manually to BulkAssetsController::restore() in existing deployments by replacing the update policy check with a delete policy check.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear && php artisan cache:clear