Vulnerability Details CVE-2026-86743
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.3%
CVSS Severity
CVSS v3 Score 5.0