CVE-2026-86757 Snipeitapp CVE debrief

Who should care

IT asset managers, administrators, and security teams responsible for Snipe-It deployments should assess their exposure and verify the version of Snipe-It in use. Those with authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions should prioritize patching or mitigating this vulnerability to prevent potential information disclosure.

Why it matters

CVE-2026-86757 is a high-severity vulnerability in Snipe-It that allows authenticated users to read plaintext encrypted custom field values. Defenders should prioritize patching or mitigating this vulnerability to prevent potential information disclosure. IT asset managers and administrators should assess their exposure and verify the version of Snipe-It in use.

• Authenticated users with certain permissions can read plaintext encrypted custom field values
• Bypasses the assets.view.encrypted_custom_fields permission check
• Potential information disclosure for sensitive data stored in custom fields
• Verification of Snipe-It version and user permissions is necessary

Technical summary

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted_custom_fields permission check.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential information disclosure. IT asset managers and administrators should assess their exposure and verify the version of Snipe-It in use.

Recommended defensive actions

• Patch Snipe-It to version 8.7.0 or later
• Verify the version of Snipe-It in use and assess exposure
• Restrict permissions for authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its severity, and affected versions. Vendor advisories and third-party advisories are also available. The vulnerability allows authenticated users with certain permissions to read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted_custom_fields permission check. This issue affects Snipe-It versions prior to 8.7.0. IT asset managers and administrators should assess their exposure and verify the Sni

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.