CVE-2026-86758: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86758 Overview

CVE-2026-86758 affects Snipe-IT asset management installations before version 8.7.0. The application fails to enforce the viewKeys authorization gate on CSV export and API index endpoints. Authenticated users holding only the licenses.view permission can retrieve product keys they were never authorized to see. Attackers can bulk-download all license keys through CSV export or validate candidate keys by observing API response discrepancies. The flaw is categorized under [CWE-204] (Observable Response Discrepancy) and stems from broken access control in the licenses module.

Critical Impact
Any authenticated Snipe-IT user with basic license viewing rights can exfiltrate every stored software license key, bypassing the dedicated viewKeys permission gate intended to restrict this sensitive data.

Affected Products

Snipe-IT open-source IT asset management platform
All versions prior to 8.7.0
Deployments exposing CSV export and licenses API index endpoints to authenticated users

Discovery Timeline

2026-09-09 - CVE-2026-86758 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86758

Vulnerability Analysis

Snipe-IT implements a granular permission model that separates the ability to view license records from the ability to view the actual product keys. The licenses.view permission grants access to license metadata such as vendor, seat counts, and expiration. A separate viewKeys gate is intended to restrict access to the sensitive serial field containing the product key.

The authorization gate is enforced correctly on the individual license detail view but was not applied consistently across the CSV export path or the API index endpoint. As a result, the key material is returned in bulk collection responses even when the requesting user lacks viewKeys.

A second exposure path exists in the API response behavior. Response differences between valid and invalid candidate keys allow an attacker to validate guesses by observing how the API handles filter or query parameters. This matches the [CWE-204] classification of an observable response discrepancy leaking sensitive state.

Root Cause

The root cause is inconsistent enforcement of the viewKeys policy across controller paths. Detail view controllers evaluated the gate before serializing the serial attribute. The CSV export controller and licenses index API serialized license models directly, including the serial column, without re-checking whether the current user held viewKeys.

Attack Vector

Exploitation requires network access to the Snipe-IT application and a valid authenticated session with licenses.view. The attacker requests the licenses CSV export endpoint or iterates the licenses API index. The response payload includes product keys for every license the user can enumerate. No privilege escalation or user interaction is required beyond the initial low-privilege login.

See the GitHub Security Advisory GHSA-5jcj-c9p3-82q7 and the VulnCheck Advisory on License Key Exposure for full technical details.

Detection Methods for CVE-2026-86758

Indicators of Compromise

Unexpected requests to the Snipe-IT licenses CSV export endpoint from accounts that do not hold the viewKeys permission.
High-volume or automated GET requests against the licenses API index endpoint, especially with pagination parameters that walk the entire dataset.
API queries containing filter parameters targeting the serial field from low-privilege accounts.
Web server access logs showing large CSV downloads correlated with sessions belonging to non-administrative users.

Detection Strategies

Review Snipe-IT application logs for CSV export actions performed by users whose role does not include viewKeys.
Alert on any single session that enumerates the licenses API index across multiple pages within a short window.
Baseline normal license export volume per user role and flag deviations for investigation.
Compare user permission assignments against actual data access observed in application audit logs.

Monitoring Recommendations

Enable Snipe-IT activity logging and forward events to a centralized log platform for correlation.
Monitor egress traffic from the Snipe-IT host for outbound transfers of CSV files to unexpected destinations.
Track HTTP response sizes on licenses endpoints; sudden increases can indicate bulk key extraction.
Instrument web application firewall or reverse proxy logging in front of the Snipe-IT instance to preserve request metadata for forensic review.

How to Mitigate CVE-2026-86758

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which enforces the viewKeys gate consistently across CSV export and API index endpoints.
Rotate all product keys stored in Snipe-IT if any account with only licenses.view may have accessed the export endpoints prior to patching.
Audit user role assignments and remove licenses.view from accounts that do not require license visibility.
Review application logs for prior bulk CSV downloads or paginated API scraping activity.

Patch Information

The fix is delivered in Snipe-IT 8.7.0. The maintainers extended the viewKeys authorization check to the CSV export controller and the licenses API index, and adjusted API responses to remove observable discrepancies that allowed candidate key validation. Refer to the GitHub Security Advisory GHSA-5jcj-c9p3-82q7 for the exact commit references and release notes.

Workarounds

Restrict network access to the Snipe-IT licenses CSV export and API index endpoints using a reverse proxy or web application firewall until the upgrade is applied.
Temporarily remove licenses.view from all non-administrator roles to reduce the population of users able to trigger the flaw.
Disable or block the licenses CSV export route at the proxy layer if it is not operationally required.
Require multi-factor authentication for all Snipe-IT accounts to raise the cost of credential-based access.

bash

# Example nginx location block to restrict licenses export and API endpoints
# to a trusted management network until Snipe-IT is upgraded to 8.7.0
location ~ ^/(licenses.*/export|api/v1/licenses) {
    allow 10.0.0.0/24;   # trusted admin network
    deny all;
    proxy_pass http://snipe_it_backend;
}