What is CVE-2026-86767?

CVE-2026-86767 is a medium-severity vulnerability in Grokability Snipe-It, classified under Information Disclosure. CVSS score: 5.0/10. Published 2026-09-09.

How severe is CVE-2026-86767?

Medium severity. CVSS v3 base score is 5.0 out of 10.

Information disclosure in Grokability Snipe-It

CVE-2026-86767

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Grokability Snipe-it

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-86767?: CVE-2026-86767 is a medium-severity vulnerability in Grokability Snipe-It, classified under Information Disclosure. CVSS score: 5.0/10. Published 2026-09-09.
How severe is CVE-2026-86767?: Medium severity. CVSS v3 base score is 5.0 out of 10.