All vulnerabilities
CVE-2026-116198GHSA-jh4g-98fm-jcqc

Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

grokability snipe-it
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8.7.0Fixed versionCVE List
Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

Text from CVE List

Affected versions 2

  • snipe-itaffected: all versions before 8.7.0CVE List
  • snipe-itunaffected: 8.7.0CVE List

References 2