Description
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| grokability | snipe-it | 8.6.3 – < 8.7.0 | 8.7.0 |
Advisories 1
- WID-SEC-2026-2981 Snipe-IT: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 24, 2026
References
- GitHub Security Advisory (GHSA-cg5w-9662-73vx) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints third-party-advisory