medium5.0
CVE-2026-86743
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acc…
Impact
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Snipeitapp | Snipe-It | before 8.7.0 |