Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the GET /api/v1/hardware//assigned/components endpoint, which does not properly enforce the required permission check. An attacker can access...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86764 Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is appli...

CVE-2026-86764: Missing Authorization

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/ /assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is...