4.3Mittel
CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Beschreibung
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| grokability | snipe-it | 8.6.3 – < 8.7.0, fixed 8.7.0 | |
| snipeitapp | snipe-it | 8.6.3 – < 8.7.0 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-cg5w-9662-73vx) vendor-advisoryExploitVendor Advisory
- Patch Commit patchPatch
- VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints third-party-advisoryThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*< 8.7.0