CVE-2026-86764

Snipe-IT through 8.6.4 contains a missing-authorization flaw (CWE-862) in its REST API: the endpoint GET /api/v1/hardware/<asset-id>/assigned/components verifies only assets.view on the parent asset and never enforces components.view, using that permission solely to set a flag in the response. Any authenticated user holding only assets.view can call this endpoint and enumerate component IDs, names, assigned quantities, and notes that should be protected, while the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden to the same users. The impact is confidentiality-only — an attacker gains read access to component assignment data, reflected in the CVSS 4.0 score of 7.1 (High) with high confidentiality impact and no integrity or availability impact. All Snipe-IT deployments running 8.6.4 or earlier are affected, particularly where low-privilege users have been granted assets.view but not components.view. There is no evidence of active exploitation: the issue is not in CISA KEV, no public proof-of-concept is known, and a fix is available in version 8.7.0.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which enforces the components.view permission on the assigned-components endpoint. As an interim mitigation, restrict API access to the /api/v1/hardware/<asset-id>/assigned/components route or limit which users hold assets.view, and review API logs for low-privilege accounts that may have queried component data. Audit component notes for any sensitive content that may have been exposed to users lacking components.view.