CVE-2026-86761
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Debilidad
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Productos afectados
- snipeitapp snipe-it
Referencias
- https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
- https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
- https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints
- https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.