PT-2026-84304

CVE-2026-84206

Published

2026-09-01

Updated

2026-09-01

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An issue exists where the bulk asset restore endpoint is restricted by the assets.edit permission rather than the assets.delete permission. This allows users who possess edit rights but lack delete rights to restore soft-deleted assets. An attacker can send asset identifiers to the bulk restore endpoint to reverse deletions performed by an administrator, thereby bypassing the intended permission separation.

Recommendations Update to version 8.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jaime Ramírez

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers