4.3Media
CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Descripción
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Debilidad (CWE):
CWE-639
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| grokability | snipe-it | 8.6.3 – < 8.7.0, fixed 8.7.0 | |
| snipeitapp | snipe-it | 8.6.3 – < 8.7.0 |
Referencias y parches
- GitHub Security Advisory (GHSA-cg5w-9662-73vx) vendor-advisoryExploitVendor Advisory
- Patch Commit patchPatch
- VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints third-party-advisoryThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*< 8.7.0