Description

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read plaintext encrypted custom field values by opening asset forms, bypassing the assets.view.encrypted_custom_fields permission check.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:25.170Z",
  "pubdate": "2026-09-09T14:17:25.170Z",
  "executiveSummary": "A critical access control vulnerability exists in Snipe-IT versions prior to 8.7.0, specifically impacting the handling of encrypted custom field values within asset form templates.\nThe vulnerability is classified as an authorization bypass, allowing authenticated users with standard asset management permissions (assets.edit, assets.checkin, assets.checkout, or assets.audit) to read sensitive, encrypted custom field values in plaintext.\nThis flaw specifically affects UI elements including listboxes, textareas, markdown-textareas, and date/datetime pickers.\nThe vulnerability stems from the application failing to enforce the 'assets.view.encrypted_custom_fields' permission check when rendering these specific form templates.\nThe risk implication is significant, as it results in unauthorized exposure of sensitive information that should be protected by cryptographic access controls.\nAn attacker must possess a valid, low-privileged user account with one of the aforementioned asset-related permissions to successfully exploit this flaw. No advanced network access or administrative privileges are required to leverage this bypass.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of authorization logic within the asset management modules of Snipe-IT. While the application defines a specific permission, 'assets.view.encrypted_custom_fields,' intended to gate access to the decrypted contents of encrypted custom fields, the form rendering logic for specific input types fails to validate this permission before populating the form data.\nWhen an authenticated user with permissions such as 'assets.edit' or 'assets.audit' navigates to an asset form template for editing or auditing, the application dynamically generates the form. For the affected UI elements (listbox, textarea, markdown-textarea, date/datetime picker), the application backend retrieves the encrypted database values, performs the necessary decryption, and injects the plaintext value directly into the form template sent to the client.\nThe attack flow is straightforward and does not require complex manipulation of HTTP requests. An attacker follows these steps: 1. Authenticate to the Snipe-IT instance with a standard user account holding sufficient permissions (e.g., assets.edit). 2. Navigate to the asset management interface. 3. Select an asset containing encrypted custom fields. 4. Open the asset form (e.g., via the edit or audit workflow). 5. Observe the plaintext content of the custom fields populated within the affected UI elements in the rendered HTML response.\nThe vulnerable components are the form template rendering functions that handle custom field injection. Because the application logic prioritizes form utility for users with edit/audit rights over the strict enforcement of granular viewing permissions, the backend indiscriminately decrypts and displays these values to the user interface, effectively bypassing the access control layer intended to restrict this sensitive data.\nThis vulnerability is present in all Snipe-IT versions prior to 8.7.0. It poses a post-exploitation risk of unauthorized information disclosure, allowing users who should only be able to modify or audit assets to view sensitive metadata, such as passwords, credentials, or other private information stored in custom fields. Since the data is returned in the HTTP response body, the information is readily accessible in the browser's Document Object Model (DOM) and network logs.\nThe exploitation does not rely on memory corruption or execution flow hijacking, but rather on an insecure design pattern regarding access control consistency across different application views and permission levels."
}