CVE-2026-86757

Snipe-IT before 8.7.0 does not properly enforce the assets.view.encrypted_custom_fields permission when rendering asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements, allowing encrypted custom-field values to be displayed in plaintext. An attacker needs only an authenticated account holding any of the assets.edit, assets.checkin, assets.checkout, or assets.audit permissions; opening the relevant asset forms triggers the flaw over the network with no user interaction required. The impact is confidential disclosure only: the attacker can read sensitive encrypted custom-field values (which may contain secrets, license keys, or other restricted asset data) but cannot modify assets or affect availability. Any organization running an affected version of the self-hosted Snipe-IT asset-management application where such permissions are granted beyond the intended audience of encrypted fields is affected. There is no known public proof-of-concept, the issue is not in CISA's KEV catalog, and no exploitation has been reported.

What to do: Upgrade to Snipe-IT 8.7.0 or later to restore the encrypted-custom-fields permission check on asset form templates. Until upgraded, restrict assets.edit, assets.checkin, assets.checkout, and assets.audit permissions to users who are already permitted to view encrypted custom fields, and review audit logs for accounts that accessed asset forms containing sensitive encrypted values.