CVE-2026-86764

Snipe-IT through 8.6.4 (fixed in 8.7.0 ) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//assigned/components . The endpoint authorizes only assets.view on the parent asset before returning linked component details; the components.view check is a...