CVE-2026-86758: Snipe-IT authorization bypass in license key export

CVE-2026-86758 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Snipe-IT is an asset management and licensing platform. A flaw in how it controls access to product license keys allows users with basic view permissions to download all license keys in bulk via CSV export or discover valid keys through API response patterns, even though only certain administrative roles should access this sensitive data. This could lead to unauthorized software activation or key reuse.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86758 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86758 being exploited in the wild.
How severe is CVE-2026-86758?
Medium severity, with a CVSS score of 6.5, published 9 September 2026.
Which products and versions are affected?
Snipe Snipe-IT before 8.7.0.
Is there a fix for CVE-2026-86758?
A patch was published on 2026-08-24: Fixed in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86758 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86758?
Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in which two code paths fail to enforce the viewKeys permission gate when accessing the serial (product key) column. Vector A affects the CSV export endpoint (GET /licenses/export), which checks only the coarser view permission and streams raw serial values without masking. Vector B affects the API index endpoint (GET /api/v1/licenses), which allows filtering by product_key and searching on serial, leaking key existence through response count discrepancies (total=0 vs total>0) rather than showing the actual key value. Both vectors require authentication but only the licenses.view permission, not the restrictive viewKeys gate that the API transformer correctly applies elsewhere. Patches were released in version 8.7.0, which applies the same masking mask used in the transformer to the CSV export, suppresses the product_key filter for unprivileged users, and removes serial from searchable attributes in free-text search.

Affected products

  • Snipe Snipe-IT before 8.7.0

Timeline

  • 2026-09-09: disclosed: Public disclosure via NVD and GitHub Security Advisory
  • 2026-08-24: patched: Fixed in version 8.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.