CVE-2026-86764

Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected — the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden for such users.

• CWE-862

• https://github.com/grokability/snipe-it/security/advisories/GHSA-v973-fm42-f8xv
• https://www.vulncheck.com/advisories/snipe-it-8.6.4-before-8.7.0-permission-bypass-via-assigned-components

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86759Snipe-IT versions before 8.7.0 fail to authorize the POST /h…7.1
• CVE-2026-8676An attacker is able to downgrade the security of a Bluetooth…8.8
• CVE-2026-86760Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) conta…5.4
• CVE-2026-86761snipe-it versions before 8.7.0 contain an authorization bypa…4.3
• CVE-2026-86762Snipe-IT before 8.7.0 does not apply the CheckUserIsActivate…8.1
• CVE-2026-86763Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authoriz…3.5
• CVE-2026-86765Snipe-IT versions before 8.7.0 fail to enforce checkout auth…6.5
• CVE-2026-86766Snipe-IT versions up to and including 8.6.3 contain a race c…6.5
• CVE-2026-86767Snipe-IT versions before 8.7.0 fail to apply company scope f…5
• CVE-2026-86768Snipe-IT before 8.7.0 fails to validate soft-deleted state i…5.4
• CVE-2026-86769Snipe-IT versions before 8.7.0 contain an improper ownership…4.3
• CVE-2026-8677The Prime Elementor Addons – Lightweight Elementor Widgets f…6.4