TI-2026-80216 Aliases CVE-2026-116198 GHSA-q5q6-6qfw-xp7h

Missing encryption of sensitive custom fields in Snipe-IT API

LOW 23CWE-311Published 2026-10-25 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-311.

Summary

Snipe-IT before 8.7.0 has a missing encryption flaw (CWE-311) in its API asset store endpoint. When callers lack the assets.view.encrypted_custom_fields permission, the endpoint writes plaintext into custom-field columns flagged as encrypted. An authenticated API user without that permission can create assets whose sensitive values persist unencrypted in the database, where backups, replicas or direct database access can expose them.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00077 0th percentileScored 2026-11-07

Fix Fixed snipe-it (grokability): 8.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
grokability	snipe-it	before 8.7.0	8.7.0	Patch available	CNA

snipe-it Vendorgrokability Affected before 8.7.0 Fixed in 8.7.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:snipeitapp:snipe-it::::::::	before 8.7.0	Vulnerable	grokability

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.7.0 Vulnerable ·grokability

Remediation

Upgrade grokability snipe-it to version 8.7.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA snipe-it (grokability) Fixed in 8.7.0

Timeline

2026-10-25 Threatist record created from CVE-2026-116198
2026-10-27 Alias added: GHSA-q5q6-6qfw-xp7h
2026-10-29 CISA SSVC decision points changed

References

Advisory 1

GitHub Security Advisory (GHSA-jh4g-98fm-jcqc)

TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4

See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences