EUVD-2026-109456

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

CVE-2026-116198

Versions of Snipe-IT before 8.7.0 are vulnerable to a missing encryption flaw in the Api echtAssetsController::store method. The root cause is that the application fails to encrypt data when callers lack the assets.view.encrypted_custom_fields permission. Consequently, authenticated API users wit...

CVE-2026-86757: Missing Authorization

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users with assets.edit, assets.checkin, assets.checkout, or assets.audit permissions can read...