Vulnerability details

CVE-2026-86758

grokability snipe-it

Snipe-IT before 8.7.0 License Key Exposure via CSV Export

CVSS 4.0

7.1High

Official description

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`
6.5Medium	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Affected products

Vendor	Product	Versions	Source
grokability	snipe-it	v < 8.7.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/grokability/snipe-it/security/advisories/GHSA-5jcj-c9p3-82q7 vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-license-key-exposure-via-csv-export third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-09
Last updated: 2026-09-09
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.41%

Probability of exploitation in 30 days

35.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-204
Observable Response Discrepancy