CVE-2026-86737: Snipeitapp Snipe-it Auth Bypass Vulnerability

CVE-2026-86737 Overview

CVE-2026-86737 is a missing authorization vulnerability [CWE-862] in Snipe-IT, an open-source IT asset management platform. Versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated users can iterate asset IDs to retrieve barcodes and enumerate asset tags belonging to other tenants, including soft-deleted and cross-company records. The flaw exposes sensitive inventory data across organizational boundaries within multi-tenant Snipe-IT deployments.

Critical Impact
Authenticated attackers can enumerate asset barcodes and tags across tenants and companies, breaking multi-tenant data isolation and exposing soft-deleted records.

Affected Products

Snipe-IT versions prior to 8.7.0
Self-hosted Snipe-IT deployments (snipeitapp/snipe-it)
Multi-company or multi-tenant Snipe-IT instances

Discovery Timeline

2026-09-08 - CVE-2026-86737 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86737

Vulnerability Analysis

The vulnerability resides in the barcode retrieval endpoint GET /hardware/{asset}/barcode. The route accepts an asset ID path parameter and returns the associated barcode image and asset tag. The controller authenticates the requesting user but skips the authorization check that verifies whether the user is permitted to view the referenced asset.

Snipe-IT enforces per-company scoping and soft-delete filtering on standard asset endpoints. The barcode route bypasses those scopes, treating any authenticated session as sufficient. As a result, low-privilege users can request barcodes for assets outside their assigned company or for records already marked as deleted.

Asset tags returned through this endpoint often encode inventory location, serial numbers, or ownership information. Enumerating across a numeric ID range yields a full map of an organization's asset inventory.

Root Cause

The root cause is a missing authorization check on the barcode controller action. The endpoint does not invoke the standard authorize('view', $asset) policy gate used by peer routes, and it does not apply the tenant Company::scopeCompanyables() restriction or the withoutTrashed() filter that excludes soft-deleted records.

Attack Vector

An authenticated attacker with any valid Snipe-IT account, including low-privilege users, issues sequential GET requests to /hardware/{id}/barcode while incrementing the {id} value. The server responds with barcode content for every existing asset ID regardless of ownership. Automated scripting allows full inventory enumeration in minutes on modestly sized deployments.

The vulnerability requires network access to the application and valid credentials. No user interaction is needed on the victim tenant side. See the Snipe-IT GitHub Security Advisory GHSA-6f4g-phw5-4g77 and the VulnCheck advisory for further technical context.

Detection Methods for CVE-2026-86737

Indicators of Compromise

Sequential or high-volume GET requests to /hardware/{id}/barcode from a single authenticated session or IP.
Successful HTTP 200 responses to /hardware/{id}/barcode for asset IDs outside the requesting user's assigned company.
Access patterns targeting asset IDs associated with soft-deleted records in the assets table.

Detection Strategies

Parse Snipe-IT web server access logs for repeated hits to the /hardware/*/barcode path and correlate with the authenticated user ID.
Compare the requesting user's company_id against the target asset's company_id in application logs to flag cross-tenant reads.
Alert on authenticated sessions retrieving barcodes at a rate inconsistent with normal operator behavior, such as more than dozens of unique asset IDs per minute.

Monitoring Recommendations

Enable verbose request logging on the Snipe-IT application tier and forward logs to a centralized SIEM for analysis.
Baseline typical barcode endpoint usage per user role and alert on statistical deviations.
Review audit logs after upgrade to identify any historical enumeration activity predating the patch.

How to Mitigate CVE-2026-86737

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which enforces authorization on the barcode endpoint.
Inventory all Snipe-IT instances across the environment and confirm the running version against the fixed release.
Rotate or reissue asset barcodes and tags that may have been exposed if enumeration is suspected in shared or multi-tenant deployments.

Patch Information

The Snipe-IT maintainers addressed the missing authorization check in release 8.7.0. Details are published in the Snipe-IT GitHub Security Advisory GHSA-6f4g-phw5-4g77. Administrators should follow the standard Snipe-IT upgrade procedure, run database migrations, and clear the application cache after deploying the update.

Workarounds

Restrict network access to the Snipe-IT web interface using an authenticated reverse proxy or IP allowlist until the upgrade is applied.
Temporarily block the /hardware/*/barcode route at the web server or WAF layer for non-administrative user roles.
Reduce the account footprint by disabling unused low-privilege accounts and enforcing strong authentication to limit who can invoke the vulnerable endpoint.

bash

# Example nginx snippet to block barcode endpoint at the proxy until patched
location ~ ^/hardware/[0-9]+/barcode$ {
    return 403;
}