CyberRota Analysis
AI-GeneratedVersions of Snipe-IT prior to 8.7.0 are vulnerable due to insufficient enforcement of asset view authorization in the GET /hardware/{asset}/barcode endpoint. This flaw allows authenticated attackers to enumerate asset IDs and retrieve sensitive barcode information, potentially exposing soft-deleted and cross-company assets. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized asset disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets.
Related CVEs
Other vulnerabilities affecting the same vendor(s)