CVE-2026-86737

Medium

Description

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.

SeverityMedium

CVSS4.3

Exploit probability—

ProductSnipeitapp Snipe-it

PublishedSep 8, 2026

First seenSep 8, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

snipeitapp snipe-it8.7.0 or later

Vendor advisories

github.com/grokability/snipe-it/security/advisories/GHSA-6f4g-phw5-4g77

Affected products

Product	Affected versions	Fixed in
snipeitapp snipe-it	v < 8.7.0	8.7.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.