# CVE-2026-86767: Snipe-IT unauthorized cross-company read in requested assets

Source: https://junglewise.ai/threats/cve-2026-86767-snipe-it-unauthorized-cross-company-read-in-requested-assets  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86767 · Severity: medium · CVSS 5 · Published 2026-09-09

Snipe-IT is asset and inventory management software. Versions before 8.7.0 fail to enforce company isolation on the pending asset requests endpoint when multi-company support is enabled. Authenticated users can view all pending requests from other companies, exposing requester names, asset names, locations, and check-in dates across the entire installation without special manipulation.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86767 being exploited in the wild.

**How severe is CVE-2026-86767?** Medium severity, with a CVSS score of 5, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86767?** A patch was published on 2026-06-22: Fix committed to develop branch (commit fbf441f2a2) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86767 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86767?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect authorization check (CWE-200, CWE-863) in the GET /hardware/requested endpoint. The root cause is twofold: (1) the CheckoutRequest model lacks company scope filtering, and (2) the authorize() call passes Asset::class as a string rather than a model instance, causing the authorization policy to bypass the per-record company scope check and collapse to a simple permission check (assets.view). An authenticated user with the routine assets.view permission can issue a single unmodified GET request to retrieve the entire cross-tenant list of pending asset requests. No parameter manipulation or user interaction is required. The vulnerability affects all FMCS-enabled installations running v8.6.3 or earlier; it was fixed in the develop branch on 2026-06-22 and ships in v8.7.0.

## Affected products

- Snipe-IT Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub security advisory published
- 2026-06-22: patched: Fix committed to develop branch (commit fbf441f2a2)
- 2026-09-09: advisory: NVD advisory published; CVE-2026-86767 assigned

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-fxm8-w79r-g7wr](https://github.com/grokability/snipe-it/security/advisories/GHSA-fxm8-w79r-g7wr)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-cross-company-read-via-requested-assets](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-cross-company-read-via-requested-assets)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)