CVE-2026-86758CWE-204

CVE-2026-86758

Medium · published September 9, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.3
In the wild
Unconfirmed
What it is

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00412 · 34.3th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-09-09T18:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (2)
https://github.com/grokability/snipe-it/security/advisories/GHSA-5jcj-c9p3-82q7 · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-license-key-exposure-via-csv-export · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    Snipe-IT before 8.7.0 License Key Exposure via CSV Export
    cvelistv5