Executive brief
snipe-it is a web-based asset management system used by organizations to track and manage IT inventory. An authorization flaw in the barcode retrieval endpoint allows any authenticated user to access barcodes and asset tags for assets they should not have permission to view, including those from other companies and deleted assets. This enables account holders to enumerate asset inventories across the organization and potentially other tenants.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the GET /hardware/{asset}/barcode endpoint within AssetsController::getBarCode. The function retrieves assets without enforcing the 'view' authorization policy that is correctly applied to similar endpoints (asset detail, label, QR code routes). An authenticated attacker can iterate asset IDs over the network to retrieve barcode PNGs for any asset in the database, including soft-deleted and cross-company assets under multi-tenant deployments. The barcode encodes the asset tag, and response differences (cached vs. freshly generated vs. null) allow enumeration as an oracle. The fix, applied in version 8.7.0, adds the missing authorize('view', $asset) check immediately after asset retrieval.
Affected products
- snipe-it snipe-it < 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-6f4g-phw5-4g77 published
- 2026-09-08: patched: Version 8.7.0 released with fix (commit 89d0abc575)
- 2026-09-08: advisory: CVE-2026-86737 and NVD entry published