Description

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-09T14:17:22.987Z",
  "pubdate": "2026-09-09T14:17:22.987Z",
  "executiveSummary": "A broken access control vulnerability exists in Snipe-IT versions prior to 8.7.0, specifically concerning the scoping of asset acceptance reports.\nThe vulnerability allows authenticated users possessing the 'reports.view' permission to bypass multi-tenancy logical boundaries.\nBy accessing the 'unaccepted_assets' report page or initiating a CSV export, unauthorized users can retrieve sensitive inventory data and assignee identities belonging to companies outside of their authorized scope.\nThis flaw represents a significant security risk to organizations utilizing Snipe-IT's multi-company feature, as it enables lateral information disclosure.\nThe vulnerability requires an authenticated session with low-level report viewing privileges; no further administrative access is required to facilitate exploitation.\nThe primary risk involves the unauthorized exposure of internal asset management data, which may include personally identifiable information (PII) of assignees and comprehensive cross-departmental inventory metadata.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of object-level authorization within the reporting module of Snipe-IT. Specifically, the backend logic responsible for generating the 'unaccepted_assets' report fails to apply restrictive database query filters based on the authenticated user's assigned company ID.\nIn a multi-tenant Snipe-IT environment, data isolation is enforced through database query scoping. However, the affected versions perform an insufficiently constrained query when fetching pending asset acceptances. The application backend fails to validate that the requested rows belong to the same company context as the authenticated session, resulting in a global scope for the query execution.\nThe exploitation flow begins when an authenticated user with 'reports.view' privileges navigates to the 'unaccepted_assets' report endpoint. Because the application logic does not perform per-row access validation during the query execution phase, the database returns a complete record set of pending acceptances from the entire system rather than the restricted set associated with the user's company.\nAttackers can trigger this exposure either by viewing the report page directly via the web interface or by invoking the export functionality, which triggers the same underlying vulnerable controller logic to generate a CSV file. The CSV export is particularly high-impact as it facilitates bulk data exfiltration of internal inventory structures.\nBecause the vulnerability exists at the controller level of the application, the system fails to enforce multi-tenancy at the data retrieval layer. Even if the UI attempts to hide certain links, the direct invocation of the report generation endpoint bypasses these interface-level controls. The lack of secondary verification—where the server-side code checks the ownership of every entity returned in the query—permits the disclosure of assignee names, asset tags, and status information belonging to other companies residing within the same Snipe-IT instance.\nThe impact includes unauthorized information disclosure that compromises organizational privacy policies and potentially violates compliance requirements regarding data segregation in multi-tenant environments."
}