---
id: CVE-2026-86764
title: >-
  Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view
  permission on the authenticated endpoint GET
  /api/v1/hardware/<asset-id>/assigned/components
summary: >-
  Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view
  permission on the authenticated endpoint GET
  /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only
  assets.view on the parent asset befor…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T01:16:31.023'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86764'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-v973-fm42-f8xv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-8.6.4-before-8.7.0-permission-bypass-via-assigned-components
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-20T00:07:23.784446Z'
epss: 0.0037
epssPercentile: 0.28089
ingestedAt: '2026-09-10T15:39:04.063Z'
---

## Overview

Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is applied only to the response's available_actions.view flag and not to the returned data. As a result, an authenticated user holding only assets.view can enumerate component IDs, names, assigned quantities, and notes that are otherwise protected — the direct GET /api/v1/components/<id> endpoint correctly returns 403 Forbidden for such users.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`