CVE-2026-86767: Snipe-IT Information Disclosure Vulnerability

CVE-2026-86767 Overview

CVE-2026-86767 is an information disclosure vulnerability in Snipe-IT, an open-source IT asset management platform. Versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. Authenticated users with the assets.view permission can read pending asset requests belonging to any tenant. Exposed data includes requested asset names, requester display names, profile links, locations, and expected check-in dates. The flaw is tracked as CWE-200: Exposure of Sensitive Information.

Critical Impact
Authenticated tenants can enumerate cross-company asset request data without parameter manipulation, breaking the multi-tenant isolation model.

Affected Products

Snipe-IT versions prior to 8.7.0
Deployments with Full Multiple Company Support enabled
Instances where users hold the assets.view permission

Discovery Timeline

2026-09-09 - CVE-2026-86767 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86767

Vulnerability Analysis

Snipe-IT enforces tenant isolation through Full Multiple Company Support, a mode that restricts each company's users to records associated with their own company scope. The GET /hardware/requested endpoint, which returns pending hardware requests, omits the company scope check applied to sibling asset endpoints. Any authenticated principal that holds the assets.view permission receives the full unfiltered result set.

The exposure is passive. Attackers do not need to modify request parameters, tamper with identifiers, or bypass authorization logic. Sending a standard authenticated request to the endpoint returns cross-tenant data by default. The disclosed fields include asset names, requester identities and profile URLs, physical locations, and expected check-in dates, which support reconnaissance for follow-on social engineering or targeted theft.

Root Cause

The root cause is a missing authorization filter in the controller handling the requested-assets listing. While the endpoint validates the caller's assets.view permission, it does not constrain the underlying query by the caller's company_id when Full Multiple Company Support is active. This constitutes broken access control at the data layer.

Attack Vector

Exploitation requires low-privilege authenticated access over the network. An attacker with any account holding assets.view in a multi-tenant Snipe-IT deployment issues a GET request to /hardware/requested and parses the JSON or HTML response for records outside their assigned company. No user interaction, elevated privileges, or specialized tooling is required.

The vulnerability is described in prose because no verified proof-of-concept exploit code has been published. Refer to the GitHub Security Advisory GHSA-fxm8-w79r-g7wr and the VulnCheck Advisory for vendor technical detail.

Detection Methods for CVE-2026-86767

Indicators of Compromise

Access log entries showing GET /hardware/requested requests from user accounts whose company_id does not match returned records.
Unusually large response payloads from the requested-assets endpoint compared to prior baselines.
Authenticated sessions from low-privilege users iterating the endpoint repeatedly within short time windows.

Detection Strategies

Review Snipe-IT web server access logs for calls to /hardware/requested correlated with the requesting user's assigned company.
Compare returned record counts against the expected per-tenant asset request volume to identify overexposure.
Alert on any authenticated request to the endpoint originating from accounts that historically do not query hardware request data.

Monitoring Recommendations

Enable verbose audit logging for permission-sensitive endpoints and forward logs to a centralized analytics platform.
Track baseline usage of the /hardware/requested endpoint per user and flag deviations.
Monitor for privilege drift where user accounts unexpectedly gain the assets.view permission.

How to Mitigate CVE-2026-86767

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which restores company scope filtering on the requested-assets endpoint.
Audit accounts holding the assets.view permission and revoke it from users who do not require it.
Review recent access logs for the affected endpoint to identify possible cross-tenant reads prior to patching.

Patch Information

The vendor addressed the issue in Snipe-IT 8.7.0. Details of the fix are documented in the GitHub Security Advisory GHSA-fxm8-w79r-g7wr. Administrators should apply the upgrade following the standard Snipe-IT upgrade procedure and validate that Full Multiple Company Support continues to enforce scope after deployment.

Workarounds

Temporarily disable Full Multiple Company Support if tenant isolation on this endpoint is not required, understanding that this changes the overall access model.
Restrict the assets.view permission to trusted administrators until the patched version is deployed.
Place the Snipe-IT instance behind a reverse proxy or Web Application Firewall (WAF) rule that blocks the /hardware/requested route for non-administrative users pending upgrade.

bash

# Example WAF-style block for the affected route pending upgrade
# nginx location block restricting /hardware/requested to admin IP ranges
location = /hardware/requested {
    allow 10.0.0.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://snipeit_backend;
}