CVE-2026-86764: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86764 Overview

CVE-2026-86764 is a broken access control vulnerability in Snipe-IT, an open-source IT asset management platform. Versions through 8.6.4 fail to enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint only validates assets.view on the parent asset before returning linked component data. Authenticated users with limited privileges can enumerate component IDs, names, assigned quantities, and notes that should remain restricted. The issue is fixed in version 8.7.0.

Critical Impact

Authenticated users holding only the assets.view permission can retrieve component details normally protected behind components.view, resulting in unauthorized information disclosure across the asset inventory.

Affected Products

• Snipe-IT versions up to and including 8.6.4
• Snipe-IT 8.7.0 (fixed release)
• Deployments exposing the /api/v1/hardware/<asset-id>/assigned/components endpoint to authenticated users

Discovery Timeline

• 2026-09-09 - CVE-2026-86764 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86764

Vulnerability Analysis

The vulnerability is a missing authorization check classified under [CWE-862]. Snipe-IT applies the components.view permission only to the response's available_actions.view flag rather than gating access to the returned data. The endpoint returns component records to any authenticated user who can view the parent asset. The direct endpoint GET /api/v1/components/<id> correctly rejects the same user with HTTP 403 Forbidden, confirming the inconsistency lies in the assigned-components route. This mismatch between UI action flags and data authorization is a common access control anti-pattern.

Root Cause

The controller behind /api/v1/hardware/<asset-id>/assigned/components authorizes only assets.view before executing the query that returns joined component records. The components.view check is delayed until response serialization, where it influences a UI hint field instead of the data payload. As a result, the permission model is enforced at the presentation layer rather than the data access layer.

Attack Vector

An attacker requires a valid Snipe-IT account and an API token with assets.view. The attacker iterates over asset IDs and issues authenticated GET requests to the vulnerable endpoint. Each response discloses linked component metadata including IDs, names, assigned quantities, and free-form notes. The vulnerability manifests over the network against the API. See the GitHub Security Advisory and the VulnCheck Advisory on Permission Bypass for the full technical description.

Detection Methods for CVE-2026-86764

Indicators of Compromise

• High volume of authenticated GET /api/v1/hardware/<asset-id>/assigned/components requests from a single user or token, especially in sequential asset-ID order
• Users lacking the components.view permission accessing component-related endpoints successfully
• API tokens generating traffic patterns inconsistent with the token owner's assigned role

Detection Strategies

• Correlate web server or reverse proxy logs with Snipe-IT role assignments to flag requests to the assigned-components endpoint from users without components.view
• Alert on enumeration patterns targeting /api/v1/hardware/*/assigned/components where a single session traverses many asset IDs in a short window
• Compare HTTP 200 responses on the vulnerable endpoint against HTTP 403 responses on /api/v1/components/<id> for the same principal to surface the discrepancy

Monitoring Recommendations

• Enable Snipe-IT activity logging and forward API access logs to a centralized SIEM for retention and correlation
• Baseline normal API consumption per token and alert on deviations in request rate or endpoint diversity
• Review Snipe-IT audit trails for unexpected component-data access by low-privilege accounts

How to Mitigate CVE-2026-86764

Immediate Actions Required

• Upgrade Snipe-IT to version 8.7.0 or later, which enforces components.view on the affected endpoint
• Audit existing API tokens and user roles, revoking any tokens issued to accounts that no longer require component visibility
• Review recent access logs for the /api/v1/hardware/*/assigned/components endpoint to identify potential unauthorized enumeration

Patch Information

The upstream fix is delivered in Snipe-IT 8.7.0. The patch adds the missing components.view authorization check to the data path of the GET /api/v1/hardware/<asset-id>/assigned/components handler. Refer to the GitHub Security Advisory GHSA-v973-fm42-f8xv for the official patch and release notes.

Workarounds

• Restrict network access to the Snipe-IT API using a reverse proxy or web application firewall (WAF) rule that blocks the vulnerable path until the upgrade is applied
• Reduce the number of accounts holding assets.view to the minimum operationally required
• Rotate API tokens after upgrading to invalidate any credentials that may have been used for enumeration

# Example NGINX rule to block the vulnerable endpoint pending patch deployment
location ~ ^/api/v1/hardware/[0-9]+/assigned/components$ {
    return 403;
}