CVE-2026-86764

    Dashboard / Vulnerabilities / CVE-2026-86764

    CVE-2026-86764

    Published: 9 Sept 2026Last Modified: 11 Sept 2026

    Summary: Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

    Details: Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected — the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden for such users.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86764.json, https://github.com/grokability/snipe-it/security/advisories/GHSA-v973-fm42-f8xv, https://nvd.nist.gov/vuln/detail/CVE-2026-86764, https://www.vulncheck.com/advisories/snipe-it-8.6.4-before-8.7.0-permission-bypass-via-assigned-components

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1d05a7ce11e6bf9448c067ac3ffbe5e63882888e

    Affected versions

    v8.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86764 | CVE-DB