CVE-2026-86764: Missing Authorization

Snipe-IT through 8.6.4 fixed in 8.7.0 does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/ /assigned/components. The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is...