CVSS 4.0
5.3 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2026-86761
Medium (5.3) in snipeitapp snipe-it. EPSS 0.4% chance of exploitation in the next 30 days.
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Severity
CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- snipeitapp:snipe-it
References
- https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
- https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
- https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints
- https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx