CVE-2026-84206

EUVD-2026-69294
Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/grokability/snipe-it
https://github.com/grokability/snipe-it/blob/v8.6.3/app/Http/Controllers/Assets/BulkAssetsController.php
https://github.com/grokability/snipe-it/commit/686329001aa457f716b269600659839a58895fee
https://github.com/grokability/snipe-it/releases/tag/v8.7.0
https://github.com/grokability/snipe-it/security/advisories/GHSA-m863-2j99-jxwm
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-bulk-restore