CVE-2026-86767 grokability CVE debrief

Who should care

Defenders responsible for Snipe-IT deployments with Full Multiple Company Support enabled should assess exposure and prioritize remediation. This includes administrators, security teams, and IT personnel managing asset requests and company scope filtering.

Why it matters

CVE-2026-86767 is a medium-severity vulnerability in Snipe-IT that allows authenticated users to read pending asset requests from all companies when Full Multiple Company Support is enabled. Defenders should prioritize verifying and remediating this vulnerability to prevent unauthorized access to sensitive asset information.

• Authenticated users can read pending asset requests from all companies
• Cross-tenant data access without parameter manipulation
• Potential unauthorized access to sensitive asset information
• Verification of company scope filtering and asset request permissions required

Technical summary

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. This allows authenticated users with assets.view permission to read pending asset requests from all companies, including requested asset names, requester display names and profile links, locations, and expected check-in dates. The vulnerability impacts Snipe-IT deployments with multiple companies and asset requests, potentially allowing unauthorized access to sensitive asset information.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Snipe-IT deployments with Full Multiple Company Support enabled, especially those with multiple companies and asset requests.

Recommended defensive actions

• Verify Snipe-IT version and configuration to determine exposure
• Restrict assets.view permission to prevent unauthorized access
• Upgrade to Snipe-IT version 8.7.0 or later
• Monitor asset requests and company scope filtering
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and NVD entry. Vendor advisory and third-party advisory sources provide additional context. The CVE record was published on 2026-09-09T14:17:27.133Z and has not been modified since then. Defenders should verify Snipe-IT version and configuration to determine exposure, and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.