Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86761snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in snipe-it from grokability. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	8.6.3 – before 8.7.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-cg5w-9662-73vx) vendor-advisory
Patch Commit patch
VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints third-party-advisory