Description

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T14:17:25.990Z",
  "pubdate": "2026-09-09T14:17:25.990Z",
  "executiveSummary": "An authorization bypass vulnerability exists within Snipe-IT versions prior to 8.7.0. The vulnerability affects the application's location-based printing endpoints, specifically printassigned and printallassigned.\nThe flaw stems from a failure to enforce granular, per-model authorization checks when accessing these endpoints. Although intended to be restricted, the endpoints allow authenticated users possessing only 'location view' permissions to bypass existing security controls.\nAn attacker can exploit this weakness to retrieve sensitive data, including details regarding users, assets, accessories, consumables, and components, without possessing the requisite permissions for those specific models.\nThis represents a significant information disclosure risk. Attackers with low-level authenticated access can perform unauthorized enumeration of organization assets and personnel, potentially facilitating further reconnaissance or targeted attacks. Exploitation requires valid user credentials and the 'location view' permission, but does not necessitate elevated administrative privileges, making it accessible to a wider range of authorized users who may have been granted limited, context-specific access.",
  "technicalDetails": "The root cause of this vulnerability lies in improper access control enforcement within the backend logic governing the printassigned and printallassigned endpoints. In affected Snipe-IT versions, the application logic assumes that a user authorized to view a specific location is inherently authorized to view all related inventory items associated with that location.\nWhen a user invokes these endpoints, the application fails to perform the secondary validation step required to verify that the requesting user possesses the necessary permissions for the specific asset models being queried. Instead, the application relies on an overly broad authorization check tied to location-level privileges.\nThe attack flow proceeds as follows: First, an attacker must authenticate to the Snipe-IT instance with at least 'location view' permissions. Second, the attacker interacts with the vulnerable print endpoints by supplying parameters that reference specific locations. Third, because the application lacks per-model access control verification, it processes the request and generates a report—typically in HTML or PDF format—that aggregates and discloses sensitive information.\nThis data includes user associations, asset inventory details, accessory lists, consumables, and component metrics. Since the application fails to filter these results based on the user's explicit model-level permissions, the attacker gains visibility into data structures they are not authorized to access. The vulnerability persists until the codebase is updated to ensure that the authorization service explicitly validates permissions for every entity being retrieved and displayed within the print generation logic.\nThis bypass exposes a significant portion of the asset management database. The impact is primarily categorized as unauthorized information disclosure, which can lead to a comprehensive map of an organization's physical and digital inventory. This information is highly valuable for subsequent lateral movement or social engineering campaigns against organizational personnel identified in the leaked data. Given that these endpoints are typically reachable via the standard web interface for authenticated users, the exposure is essentially local to the internal network or the application perimeter, but the scope of the exposure is global regarding the internal asset database."
}