CVE-2026-86743
MEDIUM
NVD
CVSS Score
5
Severity
MEDIUM
Published
Sep 09, 2026
Vendor
unknown
Description
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.