Executive brief
Snipe-IT is an open-source asset management system used by organizations to track software licenses, accessories, and consumables. An authenticated user with only basic user-viewing permissions can bypass access controls and view sensitive inventory data (license names, costs, purchase orders, and assignment notes) for any other user by accessing their detail page or print view, even though the same user would be denied direct access to the inventory modules themselves.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in Snipe-IT's user detail and print inventory endpoints. The UsersController::show() and UsersController::printInventory() methods perform only user-level authorization checks but then load and render related inventory data (licenses, accessories, consumables) without verifying that the requesting user has permission to view those specific inventory modules. The vulnerable components are app/Http/Controllers/Users/UsersController.php and the Blade templates resources/views/users/view.blade.php and resources/views/users/print.blade.php. An authenticated attacker with only the users.view permission can access GET /users/{user} or GET /users/{user}/print and receive a 200 OK response containing sensitive inventory metadata including license names, purchase costs, order numbers, and accessory/consumable details—data that would be denied if accessed directly via /licenses, /accessories, or /consumables. The vulnerability requires authentication but no user interaction. A patch is available in version 8.6.1.
Affected products
- Grokability Snipe-IT <= 8.6.0
Timeline
- 2026-08-28: disclosed: Advisory published by GitHub
- 2026-08-28: patched: Patched in version 8.6.1 (commit 374f426f0c)
References
- https://api.github.com/users/mamdouhmahfouz
- https://github.com/mamdouhmahfouz
- https://api.github.com/users/mamdouhmahfouz/gists%7B/gist_id%7D
- https://api.github.com/users/mamdouhmahfouz/repos
- https://avatars.githubusercontent.com/u/127619974?v=4
- https://api.github.com/users/mamdouhmahfouz/events%7B/privacy%7D