PT-2026-89027

CVE-2026-86758

Published

2026-09-09

Updated

2026-09-09

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Authenticated users with only licenses.view permission can access product keys because the software fails to properly enforce the viewKeys authorization gate. This allows attackers to download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies. The issue affects the CSV export and API index endpoints.

Recommendations Update to version 8.7.0 or later.

Exploitability

Exploit

Fix

Researchers

Pavelkohout396

Vendors

Affected products

Weakness enumeration

CWE-204: Observable Response Discrepancy

Related identifiers

CVE-2026-86758