# CVE-2026-86757: Snipe-IT authorization bypass in encrypted custom field form rendering

Source: https://junglewise.ai/threats/cve-2026-86757-snipe-it-authorization-bypass-in-encrypted-custom-field-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86757 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Snipe-IT is an open-source asset management system that encrypts sensitive per-asset data like passwords and API keys. Users with basic asset-editing permissions can bypass encryption controls and read plaintext secret values by opening asset forms, defeating the purpose of the encryption protection.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86757 being exploited in the wild.

**How severe is CVE-2026-86757?** Medium severity, with a CVSS score of 6.5, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86757?** A patch was published on 2026-08-24: Fixed in version 8.7.0 (commit 42a98fc) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86757 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86757?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the custom field form template. Snipe-IT encrypts sensitive custom fields and gates read access behind the assets.view.encrypted_custom_fields permission, but five form element types (listbox, textarea, markdown-textarea, and date/datetime pickers) render encrypted values without consulting this permission gate. An authenticated user holding any of assets.edit, assets.checkin, assets.checkout, or assets.audit can open asset forms and read plaintext encrypted values from pre-filled form inputs. The write path was already properly gated, so no data integrity risk exists. Fixed in version 8.7.0 by centralizing the permission check into a new helper function used across all form element types.

## Affected products

- Snipe-IT Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed: GHSA-j36v-ghpr-m963 published
- 2026-09-09: disclosed: CVE-2026-86757 published
- 2026-08-24: patched: Fixed in version 8.7.0 (commit 42a98fc)

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-j36v-ghpr-m963](https://github.com/grokability/snipe-it/security/advisories/GHSA-j36v-ghpr-m963)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-information-disclosure-via-custom-fields](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-information-disclosure-via-custom-fields)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)