CVE-2026-86743: Snipe-IT Information Disclosure Vulnerability

CVE-2026-86743 Overview

CVE-2026-86743 is an authorization bypass vulnerability in Snipe-IT, an open-source IT asset management application. Versions before 8.7.0 fail to scope asset acceptance report queries by company. Authenticated users holding the reports.view permission can read pending acceptances across all companies, bypassing the multi-tenant isolation model.

The flaw affects the unaccepted_assets report page and its CSV export. Both endpoints return records without per-row access validation, disclosing cross-company inventory details and assignee names. The weakness is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users with report viewing privileges can enumerate asset assignments and assignee identities belonging to other companies within the same Snipe-IT instance.

Affected Products

Snipe-IT versions prior to 8.7.0
Deployments using company-scoped multi-tenancy (full_multiple_companies_support)
Instances exposing the asset acceptance report to non-administrative roles

Discovery Timeline

2026-09-09 - CVE-2026-86743 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86743

Vulnerability Analysis

Snipe-IT supports multi-company deployments where assets, users, and reports are isolated by company identifier. The asset acceptance report enumerates checkouts that recipients have not yet acknowledged. In versions before 8.7.0, the query backing the unaccepted_assets report and its CSV export omits the company scoping filter applied elsewhere in the application.

Any authenticated account granted the reports.view permission can request the report and retrieve records that belong to other tenants. The response exposes asset tags, model information, and the names of users to whom assets are assigned. This defeats the tenant isolation guarantee that administrators rely on when granting reporting access to auditors, help-desk staff, or line-of-business managers.

Root Cause

The root cause is missing authorization enforcement at the query layer. Snipe-IT typically applies a company scope through a shared query modifier, but the acceptance report controller and CSV export path did not invoke it. The permission check validated that the caller could view reports without validating that each returned row belonged to the caller's company.

Attack Vector

An attacker authenticates to the Snipe-IT web interface with any account that carries the reports.view permission. The attacker navigates to the unaccepted assets report or requests its CSV export directly. The server returns pending acceptances aggregated across all companies. No exploitation code, elevated privileges, or user interaction is required beyond the initial login. See the GitHub Security Advisory GHSA-7xrr-xm47-rc6w and the VulnCheck Snipe-IT Advisory for technical details.

Detection Methods for CVE-2026-86743

Indicators of Compromise

Web server access log entries for /reports/unaccepted_assets or the associated CSV export endpoint originating from non-administrative user sessions.
Repeated report retrievals by a single account within a short time window, suggesting scripted enumeration.
CSV downloads that materially exceed the size expected for a single company's pending acceptances.

Detection Strategies

Audit Snipe-IT application logs for requests to the unaccepted assets report and cross-reference the requesting user's company assignment against the returned data set.
Alert on any account outside the global administrator group accessing the report endpoint in multi-tenant deployments.
Review Snipe-IT role assignments to identify accounts holding reports.view that should not have visibility into cross-company data.

Monitoring Recommendations

Forward Snipe-IT web and application logs to a centralized logging platform and build detections around the unaccepted assets report path.
Track baseline volume for report retrievals per user and flag statistical deviations.
Monitor for automated user agents accessing the report endpoint outside interactive browser workflows.

How to Mitigate CVE-2026-86743

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which restores company scoping on the acceptance report query.
Inventory accounts holding the reports.view permission and revoke it from users who do not require cross-company reporting.
Review recent access logs for the unaccepted assets report and notify affected tenants if cross-company disclosure occurred.

Patch Information

The fix is included in Snipe-IT 8.7.0. Refer to the GitHub Security Advisory GHSA-7xrr-xm47-rc6w for the upstream commit and release notes. Administrators running earlier 8.x releases should apply the update as part of a standard maintenance window.

Workarounds

Restrict the reports.view permission to global administrators until the upgrade is deployed.
Block access to the unaccepted assets report path at a reverse proxy or web application firewall for non-admin roles.
Disable the report from the Snipe-IT navigation for tenants that do not rely on it, reducing incidental exposure.

bash

# Example NGINX rule to restrict the vulnerable report endpoint
location ~ ^/reports/unaccepted_assets {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://snipeit_backend;
}