CVE-2026-86743

Snipe-IT versions before 8.7.0 fail to scope asset acceptance report queries by company, so any authenticated user with the reports.view permission can read pending asset acceptances belonging to all companies on the instance, not just their own. The flaw is triggered by visiting the unaccepted_assets report page or downloading its CSV export, which return cross-company rows — including inventory details and assignee names — without per-row access validation. This is an authorization bypass (CWE-639, user-controlled key) that leaks confidential asset inventory and personnel data in multi-company deployments, rated medium severity (CVSS 4.0: 5.3). Only self-hosted Snipe-IT instances running versions prior to 8.7.0 with multiple companies configured are materially affected. Exploitation likelihood appears low (EPSS 0.3%, 17th percentile), and while a vendor advisory is public, no in-the-wild exploitation is known.

What to do: Upgrade Snipe-IT to version 8.7.0 or later, which scopes asset acceptance report queries per company. Review audit and access logs for unexpected access to the unaccepted_assets report page or CSV exports by users who should not see cross-company data. As a mitigation, restrict the reports.view permission to trusted staff until the upgrade is complete.