CVE-2026-86752

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 8.7.0

Description The software fails to enforce per-instance FMCS scoping in asset audit endpoints. It relies on query-layer filtering instead of policy-layer authorization checks. This allows attackers with valid sessions and assets.audit permissions to write audit log entries against assets belonging to other companies if the query-layer scope is bypassed or refactored.

Recommendations Update to version 8.7.0 or later.