Information Exposure

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Information Exposure in the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. An attacker can access sensitive information belonging to other...

CVE-2026-86767: Exposure of Sensitive Information to an Unauthorized Actor

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tena...