Description

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, allowing authenticated users with only licenses.view permission to access product keys. Attackers can download all license keys in bulk via CSV export or validate candidate keys through API response discrepancies without needing the viewKeys permission.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T14:17:25.430Z",
  "pubdate": "2026-09-09T14:17:25.430Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in Snipe-IT versions prior to 8.7.0. The vulnerability resides within the application's access control logic, specifically regarding the viewKeys authorization gate.\nThe flaw allows authenticated users who possess only the 'licenses.view' permission to gain unauthorized access to sensitive product keys. By bypassing the intended authorization checks, attackers can leverage CSV export functionality or API index endpoints to extract or validate confidential license information.\nThe impact is significant, as it facilitates the bulk exfiltration of software license keys, compromising the confidentiality of intellectual property and potentially leading to license compliance violations or unauthorized software deployment.\nExploitation requires an authenticated session with low-level privileges, specifically the 'licenses.view' permission. No advanced administrative rights are required to trigger this failure in the authorization gate mechanism.",
  "technicalDetails": "The vulnerability stems from a failure to correctly enforce the 'viewKeys' authorization gate within the backend logic governing CSV export and API index operations. In Snipe-IT, authorization is designed to be granular, restricting access to sensitive license keys exclusively to users holding the 'viewKeys' capability.\nThe root cause is an insecure implementation of the authorization middleware or gate check in the affected controllers managing data exports and API responses. When a user requests a CSV export of license data or queries the API index endpoints, the application logic fails to perform a secondary verification of the 'viewKeys' permission before serializing the model data for output.\nThe attack flow proceeds as follows: An authenticated user with basic 'licenses.view' permissions initiates an HTTP request to the CSV export endpoint or the API index endpoint. Because the application logic fails to validate the presence of the 'viewKeys' gate, the system proceeds to retrieve the full license dataset, including the sensitive 'key' attribute. In the case of the CSV export, the server generates and returns a file containing all license keys. For the API index endpoint, the server returns a JSON payload containing license objects where the 'key' field, which should have been redacted or omitted, is exposed in the response body.\nAttackers can leverage the API endpoint to systematically validate candidate keys through response discrepancies. If an attacker has knowledge of specific license formats or uses automated tools to query the index, they can verify the presence or validity of keys without possessing legitimate administrative authorization.\nThe vulnerability affects all Snipe-IT versions prior to 8.7.0. The exploitability is constant regardless of network exposure, provided the attacker has valid, lower-privileged credentials. The post-exploitation impact includes the total loss of confidentiality for all license keys managed within the platform, enabling the unauthorized use of these assets across the organization’s environment."
}