CVE-2026-84206 - Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore
Brief
CVE ID : CVE-2026-84206
Published : Sept. 1, 2026, 4:17 p. m.
- 59 minutes ago
Description : Snipe-IT before 8.
- 0 gates the bulk asset restore endpoint on the assets. edit permission instead of assets. delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...