CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to improper scoping of asset acceptance report queries, enabling authenticated users to view pending acceptances across all companies. This flaw allows unauthorized disclosure of cross-company inventory details and assignee names through the unaccepted_assets report page or CSV export. Organizations using affected versions should prioritize patching to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)