Which versions of Snipe-IT are affected by CVE-2026-86758?

Organizations running Snipe-IT before version 8.7.0 face immediate intellectual property exposure as all product license keys become accessible to any staff member with basic system access.. A patch is available.

How to fix or mitigate CVE-2026-86758?

Within 24 hours, identify and inventory all Snipe-IT instances to determine which versions are deployed and exposed. Within 7 days, upgrade all affected Snipe-IT installations to version 8.7.0 or later to remediate the authorization bypass, and review access logs from the past 90 days for evidence of unauthorized license key retrieval. Within 30 days, enforce role-based access controls to restrict license key visibility to authorized administrative personnel only, and establish monitoring alerts on all license key export and access activities.

Snipe-IT CVE-2026-86758

Q: What is the CVSS score of CVE-2026-86758?

CVE-2026-86758 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-74935 HIGH

Observable Response Discrepancy (CWE-204)

2026-09-09 VulnCheck

GHSA-92c9-89q4-cr7x

Information Disclosure Snipe It Grokability

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Low-privilege authentication required (PR:L); network-accessible with no complexity; confidentiality-only impact as license keys are disclosed but no integrity or availability effect exists.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

POC Analysis Generated

Sep 09, 2026 - 15:25 vuln.today

Analysis Generated

Sep 09, 2026 - 14:44 vuln.today

Patch available

Sep 09, 2026 - 14:19 EUVD

CVE Published

Sep 09, 2026 - 13:32 cve.org

HIGH 7.1

DescriptionCVE.org

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

AnalysisAI

License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid Snipe-IT account holding at minimum the licenses.view permission - no administrative rights or the viewKeys permission are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) is a reasonable characterization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade Snipe-IT to version 8.7.0 or later, which properly enforces the viewKeys authorization gate across both the CSV export and API index endpoints. … Detailed patch versions, workarounds, and compensating controls in full report.