# CVE-2026-86743: Snipe-IT asset acceptance report authorization bypass

Source: https://junglewise.ai/threats/cve-2026-86743-snipe-it-asset-acceptance-report-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86743 · Severity: medium · CVSS 5 · Published 2026-09-09

Snipe-IT is an open-source asset management system used to track corporate inventory. An authenticated user with basic reporting permissions can view pending asset acceptances from all companies on a multi-tenant installation, bypassing company access controls. This allows disclosure of cross-company inventory details, item tags, and the names of employees assigned to assets without authorization.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86743 being exploited in the wild.

**How severe is CVE-2026-86743?** Medium severity, with a CVSS score of 5, published 9 September 2026.

**Which products and versions are affected?** Grokability Snipe-IT < 8.7.0.

**Is there a fix for CVE-2026-86743?** A patch was published on 2026-09-09: Version 8.7.0 released with fix (commit 81c0763) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86743 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86743?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Snipe-IT's asset acceptance report endpoints (/reports/unaccepted_assets page render and CSV export) fail to scope CheckoutAcceptance queries by company and lack per-row access validation. The vulnerability affects ReportsController::getAssetAcceptanceReport and ReportsController::postAssetAcceptanceReport, which check only for the 'reports.view' permission without filtering results by the authenticated user's company membership. Under Full Multiple Company Support (FMCS), an authenticated reports.view user can retrieve pending acceptances from all companies in the database, including asset tags, item names, categories, and assignee display names. The mutating actions on the same report (reminder and delete) correctly use currentUserCanAccessAcceptance() for authorization, but the read paths did not. The fix applies per-row access filtering to both read paths before results are rendered or exported.

## Affected products

- Grokability Snipe-IT < 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory published
- 2026-09-09: patched: Version 8.7.0 released with fix (commit 81c0763)
- 2026-09-09: advisory: CVE-2026-86743 published

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w](https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-asset-acceptance-report](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-asset-acceptance-report)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)