CVE-2026-86761
Low
No strong exploitation signal.
CVSS base
4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS — probability of exploitation (30 days)
0.2%
15.7th percentile
CISA KEV
Not listed
Weakness / dates
CWE-639
Published 2026-09-09 · modified 2026-09-16
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | L | Low |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-09-09 — Published (NVD)
- 2026-09-16 — Last modified (NVD)
Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Affected
References
- https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
- exploit https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
- https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints
- exploit https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx