CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to improper enforcement of the viewKeys authorization gate, allowing authenticated users with limited permissions to access sensitive product license keys. This flaw enables attackers to exploit CSV export and API endpoints to download all license keys in bulk or validate keys without appropriate authorization. Organizations using Snipe-IT should prioritize this vulnerability to safeguard their license management and prevent unauthorized access to sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.