CVE-2026-86758

Snipe-IT before 8.7.0 does not consistently enforce the viewKeys authorization gate on the license CSV export and API index endpoints, a flaw tracked as CWE-204 (observable response discrepancy). An authenticated user who holds only the licenses.view permission can trigger a bulk CSV export and retrieve all license product keys, or can validate guessed keys by observing differences in API responses, without ever being granted the more restrictive viewKeys permission. The attacker gains read access to sensitive product/license keys across the organization; confidentiality impact is high, while integrity and availability are unaffected. Any Snipe-IT deployment running a version prior to 8.7.0 in which non-administrative users hold licenses.view is affected. There is currently no public proof-of-concept, no evidence of exploitation in the wild, and the issue is not listed in CISA KEV.

What to do: Upgrade Snipe-IT to version 8.7.0 or later, which properly enforces the viewKeys gate on the CSV export and API index endpoints. As an interim measure, review which accounts hold licenses.view versus viewKeys and restrict non-privileged users' access to the license export and API endpoints, then audit exports/API logs to determine whether license keys were accessed by under-privileged users; consider rotating any highly sensitive keys that were exposed.