4.3Orta
CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Açıklama
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Zayıflık türü (CWE):
CWE-639
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| grokability | snipe-it | 8.6.3 – < 8.7.0, fixed 8.7.0 | |
| snipeitapp | snipe-it | 8.6.3 – < 8.7.0 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-cg5w-9662-73vx) vendor-advisoryExploitVendor Advisory
- Patch Commit patchPatch
- VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints third-party-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*< 8.7.0