CVE-2026-116198

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists in the ApiAssetsController::store function where plaintext is written into custom-field columns flagged for encryption when the caller lacks the assets.view.encrypted custom fields permission. Authenticated API users without this permission can create assets with sensitive custom-field values that remain unencrypted in the database, potentially exposing the data through backups, replicas, or direct database access.

Recommendations Update to version 8.7.0 or later.