CVE-2026-86761

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a	Patch
https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints	Third Party Advisory
https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

History

16 Sep 2026, 20:26

Type	Values Removed	Values Added
References	~~() https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a -~~	() https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a - Patch
References	~~() https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx -~~	() https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx - Exploit, Vendor Advisory
References	~~() https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints -~~	() https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints - Third Party Advisory
First Time		Snipeitapp snipe-it Snipeitapp
CPE		cpe:2.3:a:snipeitapp:snipe-it::::::::

Information

Published : 2026-09-09 14:17

Updated : 2026-09-16 20:26

NVD link : CVE-2026-86761

Mitre link : CVE-2026-86761

CVE.ORG link : CVE-2026-86761

JSON object : View

Products Affected

snipeitapp

snipe-it

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-86761", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86761", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-09T14:20:38.231057Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "8.6.3", "lessThan": "8.7.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-09T14:17:25.990", "references": [{"url": "https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions."}], "lastModified": "2026-09-16T20:26:56.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F553C45E-A829-4438-BA02-5FA70B55FB5A", "versionEndExcluding": "8.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}