GHSA-j39q-crq5-g32gMediumCVSS 4.3
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print...
🔗 CVE IDs covered (1)
📋 Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
🔗 References (5)
- https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
- https://nvd.nist.gov/vuln/detail/CVE-2026-86761
- https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
- https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints
- https://github.com/advisories/GHSA-j39q-crq5-g32g