CVE-2026-84206

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists where the bulk asset restore endpoint is restricted by the assets.edit permission rather than the assets.delete permission. This allows users who possess edit rights but lack delete rights to restore soft-deleted assets. An attacker can send asset identifiers to the bulk restore endpoint to reverse deletions performed by an administrator, thereby bypassing the intended permission separation.

Recommendations Update to version 8.7.0 or later.