Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Priority MEDIUM 57CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00377 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snipe-it (grokability): 8.7.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | before 8.7.0 | 8.7.0 | Patch available | CNA |
- snipe-it Vendorgrokability Affected before 8.7.0 Fixed in 8.7.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | before 8.7.0 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.7.0 Vulnerable ·grokability
Remediation
- Fix · CNA snipe-it (grokability) Fixed in 8.7.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-84206
References
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences