Snipe-IT EUVD-2026-42994

Exploitation requires a valid authenticated session in Snipe-IT with at minimum the users.view permission - this is the only prerequisite. No special deployment configuration, non-default feature, or elevated privilege beyond this common role is needed; the flaw exists in the default controller behavior for any Snipe-IT instance prior to 8.6.2. The users.view permission is routinely granted to helpdesk and IT support staff, making the realistic attacker pool broad within any organization using Snipe-IT. What limits exploitation: the attacker must hold valid credentials to the Snipe-IT instance (PR:L - unauthenticated exploitation is not possible); the data exposed is scoped to inventory and cost metadata for items assigned to users the attacker can already view (not arbitrary database access); and there is no integrity or availability impact - exploitation is purely read-only disclosure of financial and asset data.

The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is an accurate representation of real-world risk. The confidentiality impact is intentionally scoped to Low - the exposed data is inventory metadata (cost, order information, assigned asset lists) rather than credentials, PII, or system secrets. Attack complexity is Low and no special deployment configuration is needed, meaning any user with a valid users.view account can exploit this immediately. However, the prerequisite of authenticated access (PR:L) meaningfully constrains the attacker pool to internal users or those who have already compromised credentials. No EPSS data was provided, so exploitation probability cannot be quantified; the absence from CISA KEV and no reported POC code suggest exploitation is not occurring at scale. For organizations that use Snipe-IT's granular permission model as a deliberate security boundary - for example, separating helpdesk staff from procurement staff who manage cost-sensitive licensing data - this flaw meaningfully violates that boundary. For small or single-team deployments where users.view holders already have broad access, the practical impact is negligible. The overall priority should be moderate: patch promptly in enterprise multi-role environments, lower urgency for small deployments.

An authenticated helpdesk technician with only the users.view role navigates to another user's profile page at /users/{id} or accesses the printInventory endpoint in Snipe-IT before version 8.6.2. The controller loads and renders all assigned licenses (including license keys and seat costs), accessories, and consumables for that user without checking whether the requesting technician holds the corresponding module-level view permissions. The technician can systematically enumerate procurement cost data and license assignments across all users they can view, bypassing the organization's intended role-based access controls for financial and inventory data.