CVE-2026-86761CWE-639

CVE-2026-86761

Medium · published September 9, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-09T18:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (4)
https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx · [email protected]https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints · [email protected]https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
    cvelistv5