CVE-2026-84206CWE-863broken-access-control

CVE-2026-84206

Medium · published September 1, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-01T20:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (7)
https://github.com/grokability/snipe-it · [email protected]https://github.com/grokability/snipe-it/blob/v8.6.3/app/Http/Controllers/Assets/BulkAssetsController.php · [email protected]https://github.com/grokability/snipe-it/commit/686329001aa457f716b269600659839a58895fee · [email protected]https://github.com/grokability/snipe-it/releases/tag/v8.7.0 · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-bulk-restore · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 15:19Z
    Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
    cvelistv5