CVE-2026-86737: 
NixOS vulnerability analysis and mitigation

CVE-2026-86737 is a missing authorization vulnerability in Snipe-IT, an open-source IT asset management application developed by Grokability, Inc. The flaw affects all versions before 8.7.0 (up to and including 8.6.3) and allows any authenticated user to retrieve barcode images for arbitrary assets — including soft-deleted and cross-tenant assets — by iterating asset IDs via the GET /hardware/{asset}/barcode endpoint. It was published on September 8, 2026, with a patch released in version 8.7.0. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-862 (Missing Authorization) in the AssetsController::getBarCode method within app/Http/Controllers/Assets/AssetsController.php. The method fetched assets using Asset::withTrashed()->find($assetId) — which includes soft-deleted records — and generated the barcode PNG without invoking the $this->authorize('view', $asset) policy check that all sibling routes (asset detail, label, QR code) correctly enforce. Because no authorization gate was applied, any authenticated user could supply arbitrary integer asset IDs in the URL path and receive the corresponding barcode PNG, which encodes the asset's asset_tag field. Under Snipe-IT's Full Multi-Company Support (FMCS) mode, this became a cross-tenant enumeration primitive, as assets belonging to other companies were equally accessible (GitHub Advisory).

Successful exploitation exposes asset tags and barcode data for all assets in the database to any authenticated user, regardless of their assigned permissions or company scope. In multi-tenant FMCS deployments, this constitutes a full cross-tenant asset-tag enumeration primitive, leaking organizational inventory data across company boundaries. Additionally, the endpoint's behavior (returning a cached PNG for in-scope assets, a freshly generated one for uncached assets, and null for missing IDs) functions as an oracle that reveals asset existence and soft-deletion state, enabling attackers to map the full asset inventory including deleted records (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires valid authentication credentials, which limits the attack surface to insiders or users who have obtained a login. The EPSS score is approximately 0.168%, reflecting a low probability of near-term exploitation. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Log in to the target Snipe-IT instance with any valid user account, regardless of assigned role or company.
2. Identify the barcode endpoint: Locate the vulnerable route at GET /hardware/{assetId}/barcode, where {assetId} is an integer primary key.
3. Iterate asset IDs: Use a scripted HTTP client (e.g., curl, Python requests, or Burp Suite Intruder) to sequentially request GET /hardware/1/barcode, GET /hardware/2/barcode, etc., including a valid session cookie or Bearer token.
4. Analyze responses: A returned PNG image indicates an existing (or previously existing) asset; a null/empty response indicates no asset at that ID. The response timing or caching behavior (pre-cached vs. freshly generated PNG) can further distinguish active from soft-deleted assets.
5. Extract asset tags: Decode the barcode PNG using any barcode-reading library or tool to recover the asset_tag value encoded within, building a full inventory of assets across all tenants (GitHub Advisory).

• Network: High volume of sequential GET /hardware/{id}/barcode requests from a single authenticated session or IP address, especially spanning a wide numeric ID range.
• Logs: Web server or application access logs showing repeated requests to the /hardware/*/barcode pattern with incrementing integer path segments from a single user account or session token.
• Logs: Requests returning barcode PNGs for asset IDs that belong to other companies or that correspond to soft-deleted assets (identifiable by cross-referencing the asset database).
• File System: Unusual access patterns to public/uploads/barcodes/ directory, particularly reads of barcode files for assets not associated with the requesting user's company.

Upgrade Snipe-IT to version 8.7.0 or later, which fixes the issue by adding $this->authorize('view', $asset) immediately after the asset lookup in AssetsController::getBarCode, matching the authorization pattern used by all sibling routes (commit 89d0abc575) (GitHub Advisory). As a temporary workaround for organizations unable to upgrade immediately, restrict network-level access to the /hardware/{asset}/barcode endpoint to trusted users or internal networks via a reverse proxy or WAF rule. Additionally, implement rate limiting on the endpoint to slow enumeration attempts, and audit access logs for sequential barcode retrieval patterns indicative of ID iteration.

The vulnerability was reported by security researcher PizzaStev3 (Ahmed Mohammed) and disclosed through GitHub's security advisory process (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory has been identified at this time.