Is CVE-2026-86752 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86752 being exploited in the wild.

How severe is CVE-2026-86752?

Medium severity, with a CVSS score of 5.4, published 9 September 2026.

Which products and versions are affected?

grokability snipe-it before 8.7.0.

Is there a fix for CVE-2026-86752?

A patch was published on 2026-09-09: Fix available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86752 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86752?

Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86752: snipe-it asset audit endpoints authorization bypass

CVE-2026-86752 · Severity: medium · CVSS 5.4 · Published 2026-09-09

snipe-it is an open-source asset management system used to track inventory and IT equipment across organizations. Versions before 8.7.0 contain a flaw in asset audit endpoints that fails to properly validate user permissions at the policy level, instead relying solely on database-layer filtering. An authenticated attacker with audit permissions could potentially write audit log entries against assets they should not have access to if the database filter were bypassed or refactored.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86752 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86752 being exploited in the wild.
How severe is CVE-2026-86752?: Medium severity, with a CVSS score of 5.4, published 9 September 2026.
Which products and versions are affected?: grokability snipe-it before 8.7.0.
Is there a fix for CVE-2026-86752?: A patch was published on 2026-09-09: Fix available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86752 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86752?: Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a class of incorrect authorization (CWE-863) in snipe-it's asset audit endpoints. Three shipped audit endpoints in AssetsController (web GET/POST and API POST) invoke authorize('audit', Asset::class) with the class rather than the specific asset instance, bypassing per-instance FMCS (Fixed Multi-Company Scoping) checks that the AssetPolicy::audit method would enforce. Per-asset authorization is currently enforced entirely at the query layer via the CompanyableScope global scope, which filters Asset lookups. An attacker with a valid session, assets.audit role permission, and knowledge of a cross-company asset ID could write audit entries across company boundaries if the query-layer scope were removed or bypassed. The fix adds explicit per-instance authorize('audit', $asset) calls after route model binding, enforcing FMCS at the policy layer independently. Patch available in version 8.7.0.

Affected products

grokability snipe-it before 8.7.0

Timeline

2026-08-24: disclosed
2026-09-09: advisory
2026-09-09: patched: Fix available in version 8.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.