CVE-2026-84206

Published: Sep 1, 2026Modified: Sep 4, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (7)

https://github.com/grokability/snipe-it

Source: disclosure@vulncheck.com

https://github.com/grokability/snipe-it/blob/v8.6.3/app/Http/Controllers/Assets/BulkAssetsController.php

Source: disclosure@vulncheck.com

https://github.com/grokability/snipe-it/commit/686329001aa457f716b269600659839a58895fee

Source: disclosure@vulncheck.com

https://github.com/grokability/snipe-it/releases/tag/v8.7.0

Source: disclosure@vulncheck.com

https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-bulk-restore

Source: disclosure@vulncheck.com

https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.