Executive brief
Snipe-IT is an open-source asset management system that encrypts sensitive per-asset data like passwords and API keys. Users with basic asset-editing permissions can bypass encryption controls and read plaintext secret values by opening asset forms, defeating the purpose of the encryption protection.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the custom field form template. Snipe-IT encrypts sensitive custom fields and gates read access behind the assets.view.encrypted_custom_fields permission, but five form element types (listbox, textarea, markdown-textarea, and date/datetime pickers) render encrypted values without consulting this permission gate. An authenticated user holding any of assets.edit, assets.checkin, assets.checkout, or assets.audit can open asset forms and read plaintext encrypted values from pre-filled form inputs. The write path was already properly gated, so no data integrity risk exists. Fixed in version 8.7.0 by centralizing the permission check into a new helper function used across all form element types.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed: GHSA-j36v-ghpr-m963 published
- 2026-09-09: disclosed: CVE-2026-86757 published
- 2026-08-24: patched: Fixed in version 8.7.0 (commit 42a98fc)