PT-2026-89026

CVE-2026-86757

Published

2026-09-09

Updated

2026-09-09

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Insufficient access control allows authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions to read plaintext encrypted custom field values. This occurs when opening asset forms for listbox, textarea, markdown-textarea, and date/datetime picker elements, effectively bypassing the assets.view.encrypted custom fields permission check.

Recommendations Update to version 8.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pavelkohout396

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers