Medium severity · published Sep 9, 2026
CVE-2026-86761
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
snipe-it · grokability
8.6.3 before 8.7.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86761
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86761
Patch
https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a
Exploit
https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx
Third Party Advisory
https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints
More from snipe-it
9.6
CVE-2026-86751
Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown
8.8
CVE-2026-116201
Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
8.8
CVE-2026-85617
snipe-it before 8.6.3 Authorization Bypass via Bulk Delete
8.8
CVE-2026-55643
Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
8.8
CVE-2026-55483
Snipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation