CVE-2026-86757: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86757 Overview

CVE-2026-86757 is an information disclosure vulnerability in Snipe-IT, an open-source IT asset management platform maintained by Grokability. Versions prior to 8.7.0 fail to properly gate access to encrypted custom-field values rendered inside asset form templates. Authenticated users holding assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can view plaintext values of encrypted custom fields by opening asset edit forms. The flaw bypasses the intended assets.view.encrypted_custom_fields permission check. The exposure affects listbox, textarea, markdown-textarea, and date/datetime picker field types. The vulnerability is tracked as a Missing Authorization weakness ([CWE-862]).

Critical Impact

Low-privileged authenticated users can read encrypted custom-field data such as license keys, credentials, or PII stored on assets, bypassing the dedicated permission designed to protect these values.

Affected Products

• Snipe-IT versions prior to 8.7.0
• Deployments using encrypted custom fields on asset forms
• Instances granting assets.edit, assets.checkin, assets.checkout, or assets.audit permissions to non-privileged roles

Discovery Timeline

• 2026-09-09 - CVE-2026-86757 published to the National Vulnerability Database
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86757

Vulnerability Analysis

Snipe-IT supports custom fields on assets and allows administrators to mark specific fields as encrypted so their values are protected at rest. A dedicated permission, assets.view.encrypted_custom_fields, gates who can read the decrypted plaintext of those values in the user interface.

The asset form templates responsible for rendering listbox, textarea, markdown-textarea, and date/datetime picker controls do not enforce this permission when populating the field's default value. When a user with any permission that opens an asset form loads the page, the decrypted plaintext is injected directly into the HTML input element. As a result, permissions intended for routine asset workflows grant read access to sensitive data that should be restricted.

Root Cause

The root cause is a missing authorization check in the affected Blade template partials ([CWE-862]). The templates rely on the presence of an editing permission as an implicit authorization signal rather than explicitly verifying assets.view.encrypted_custom_fields before decrypting and outputting the field value.

Attack Vector

Exploitation requires an authenticated account with one of the affected permissions. The attacker navigates to an asset edit, checkin, checkout, or audit form containing an encrypted custom field of an affected type. The plaintext value appears in the rendered HTML, either as the value attribute of the input or within the textarea body. The attacker can view it in the browser, in page source, or by inspecting the DOM. No exploit tooling is required and no code execution is involved.

See the GitHub Security Advisory GHSA-j36v-ghpr-m963 for maintainer details.

Detection Methods for CVE-2026-86757

Indicators of Compromise

• Web server access logs showing repeated GET requests to asset edit, checkin, checkout, or audit endpoints by low-privileged user accounts
• Users without the assets.view.encrypted_custom_fields permission accessing assets that contain encrypted custom fields
• Unusual volume of asset form views from a single session or account outside normal workflow patterns

Detection Strategies

• Review Snipe-IT application and Laravel logs to correlate asset form access with the permission set of the requesting user
• Enumerate all roles in Snipe-IT and identify which non-administrator roles hold assets.edit, assets.checkin, assets.checkout, or assets.audit
• Query the database for assets containing encrypted custom fields of type listbox, textarea, markdown-textarea, or date/datetime picker and treat prior views by non-privileged users as suspect

Monitoring Recommendations

• Forward Snipe-IT web and audit logs to a centralized log platform and alert on asset form access by accounts lacking the encrypted-field permission
• Baseline typical asset form access rates per user and alert on deviations that may indicate scripted enumeration
• Monitor authentication logs for new or unexpected accounts being granted asset-editing permissions

How to Mitigate CVE-2026-86757

Immediate Actions Required

• Upgrade Snipe-IT to version 8.7.0 or later, which restores the authorization check on encrypted custom-field rendering
• Audit all user roles and remove assets.edit, assets.checkin, assets.checkout, and assets.audit permissions from accounts that do not strictly require them
• Rotate any secrets, license keys, or credentials stored in encrypted custom fields that may have been exposed to unauthorized users

Patch Information

The issue is fixed in Snipe-IT 8.7.0. Administrators should follow the upgrade path published by Grokability and verify database migrations complete successfully. Additional detail is available in the Vulncheck advisory for Snipe-IT and the GitHub Security Advisory GHSA-j36v-ghpr-m963.

Workarounds

• Temporarily convert sensitive custom fields to non-encrypted informational fields stored outside Snipe-IT until the upgrade is applied
• Restrict asset-editing permissions to a small set of trusted administrators pending the patch
• Remove encrypted custom fields of the affected types (listbox, textarea, markdown-textarea, date/datetime picker) from asset forms if the data is not critical to workflow

# Configuration example: upgrade Snipe-IT to a patched release
cd /var/www/snipe-it
php artisan down
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear
php artisan up