Live › vulnerability › CVE-2026-116198
Go to dashboardSnipe-IT before 8.7.0 accepts asset creation through its API from users who lack the encrypted custom fields permission, and it saves values for encrypted-flagged custom fields in plaintext. An attacker with a low-privilege API token can get sensitive values into the database unencrypted, where they can be read from backups, replicas or direct database access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams running self-hosted Snipe-IT before 8.7.0 that use encrypted-flagged custom fields on assets and grant API access to users or tokens without the encrypted custom fields permission. Installations that do not use encrypted custom fields or do not expose the API to such users are less exposed. Teams on managed hosting should confirm the vendor has applied the update.
No product ranges from the sources yet.
composer.json or the admin footer, and see whether it is below 8.7.0assets.view.encrypted_custom_fields permission and whether they can create assets8.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.
This page as .md · .json · in your agent: get_signal("CVE-2026-116198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.