CVE-2026-86761: Snipe-IT Authorization Bypass Vulnerability

CVE-2026-86761 Overview

CVE-2026-86761 is an authorization bypass vulnerability in Snipe-IT asset management software versions before 8.7.0. The flaw exists in location print endpoints that fail to enforce per-model authorization checks. Authenticated users holding only the location view permission can invoke the printassigned and printallassigned endpoints to retrieve data about related users, assets, accessories, consumables, and components. This exposes information the user should not be able to access under normal role-based permission enforcement. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers with minimal location view permissions can enumerate assigned users, assets, accessories, consumables, and components across the Snipe-IT deployment, bypassing per-model access controls.

Affected Products

Snipe-IT versions 8.6.3 and earlier
Snipe-IT versions prior to 8.7.0
Deployments exposing printassigned and printallassigned location endpoints

Discovery Timeline

2026-09-09 - CVE-2026-86761 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86761

Vulnerability Analysis

Snipe-IT is an open-source IT asset management platform. The application enforces granular, per-model permissions covering assets, users, accessories, consumables, and components. The printassigned and printallassigned endpoints in the LocationsController generate printable reports for items assigned to a location.

Before version 8.7.0, these controllers only checked whether the caller could view the Location model. They did not evaluate whether the caller had view authorization for each related model returned in the print output. An authenticated user with only location visibility could therefore enumerate items across the estate through these report endpoints.

Root Cause

The controllers omitted Gate authorization checks for the child models included in the print response. The remediation, published in commit 7865bc56e372447631b6c0d6eb6774faf896553a, imports the Accessory, Component, and Consumable models along with Illuminate\Support\Facades\Gate to apply tighter constraints on print views.

Attack Vector

An authenticated user with the location view permission issues an HTTP request to a vulnerable print endpoint. The controller returns records for related users, assets, accessories, consumables, and components without verifying per-model permissions. The exposure is limited to information disclosure; integrity and availability of the underlying data are not affected.

php

// Patch excerpt: app/Http/Controllers/LocationsController.php
 use App\Helpers\Helper;
 use App\Http\Requests\ImageUploadRequest;
+use App\Models\Accessory;
 use App\Models\Actionlog;
 use App\Models\Asset;
 use App\Models\Company;
+use App\Models\Component;
+use App\Models\Consumable;
 use App\Models\Location;
 use App\Models\Setting;
 use App\Models\User;
 use Illuminate\Contracts\View\View;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Storage;
// Source: https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a

Detection Methods for CVE-2026-86761

Indicators of Compromise

HTTP GET requests to URIs containing printassigned or printallassigned under /locations/.
Requests to these endpoints from user accounts that do not have explicit view permissions on assets, users, accessories, consumables, or components.
Unusual volumes of print report requests from a single authenticated session across multiple location identifiers.

Detection Strategies

Parse Snipe-IT web server access logs for printassigned and printallassigned paths and correlate with the authenticated user's role assignments.
Baseline typical print endpoint usage per user; alert on deviations such as sequential enumeration of location IDs.
Compare accessed record counts in application logs against the caller's expected permission scope.

Monitoring Recommendations

Enable detailed request logging on the Snipe-IT reverse proxy or load balancer to capture URI, user agent, and authenticated user identifier.
Forward Snipe-IT application and web logs to a centralized analytics platform for correlation with identity events.
Monitor for account behavior anomalies where low-privilege accounts issue high-volume report queries.

How to Mitigate CVE-2026-86761

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which applies per-model Gate authorization checks in the print controllers.
Audit user and role assignments to confirm the principle of least privilege for location view permissions.
Review recent access logs for printassigned and printallassigned requests to identify potential prior enumeration.

Patch Information

The fix is delivered in commit 7865bc56e372447631b6c0d6eb6774faf896553a and released in Snipe-IT 8.7.0. Details are published in GitHub Security Advisory GHSA-cg5w-9662-73vx and the VulnCheck Advisory for Snipe-IT.

Workarounds

Restrict access to the Snipe-IT web interface through network segmentation or a VPN until the upgrade is applied.
Temporarily revoke the location view permission from users who do not also hold matching permissions on assets, users, accessories, consumables, and components.
Add a reverse proxy rule that blocks unauthenticated or low-privilege access paths to printassigned and printallassigned routes.

bash

# Example nginx rule to restrict access to Snipe-IT print endpoints by source IP
location ~* /locations/.*/(printassigned|printallassigned) {
    allow 10.0.0.0/8;    # trusted administrative network
    deny all;
    proxy_pass http://snipe_it_backend;
}