{"id":"CVE-2026-116198","kind":"vulnerability","aliases":["CVE-2026-116198"],"related":[],"title":"Snipe-IT: API asset creation stores encrypted custom fields as plaintext","description":"Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.","summary":"Snipe-IT before 8.7.0 accepts asset creation through its API from users who lack the encrypted custom fields permission, and it saves values for encrypted-flagged custom fields in plaintext. An attacker with a low-privilege API token can get sensitive values into the database unencrypted, where they can be read from backups, replicas or direct database access.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","package","php","self-hosted","snipe-it"],"not_affected_if":["api-disabled","managed-hosting-patched","no-encrypted-custom-fields"],"how_to_check":"- Check the installed Snipe-IT version, for example in the app's `composer.json` or the admin footer, and see whether it is below `8.7.0`\n- Review which API tokens and users lack the `assets.view.encrypted_custom_fields` permission and whether they can create assets\n- unknown","fix":"- Upgrade Snipe-IT to `8.7.0` or later\n- Rotate any sensitive values stored in encrypted-flagged custom fields that were written through the API before the upgrade, and purge unencrypted copies from backups as needed","status":"open","published_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:43:03+00:00","updated_at":"2026-10-25T14:43:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:43:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Snipe-IT to `8.7.0` or later\n- Rotate any sensitive values stored in encrypted-flagged custom fields that were written through the API before the upgrade, and purge unencrypted copies from backups as needed","reach":"network","title":"Snipe-IT: API asset creation stores encrypted custom fields as plaintext","impact":"medium","summary":"Snipe-IT before 8.7.0 accepts asset creation through its API from users who lack the encrypted custom fields permission, and it saves values for encrypted-flagged custom fields in plaintext. An attacker with a low-privilege API token can get sensitive values into the database unencrypted, where they can be read from backups, replicas or direct database access.","category":"package","nicknames":[],"who_cares":["snipe-it","self-hosted","api","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"sensitive custom-field values stored unencrypted in the database","analyst_note":"","how_to_check":"- Check the installed Snipe-IT version, for example in the app's `composer.json` or the admin footer, and see whether it is below `8.7.0`\n- Review which API tokens and users lack the `assets.view.encrypted_custom_fields` permission and whether they can create assets\n- unknown","needs_analyst":false,"not_affected_if":["no-encrypted-custom-fields","api-disabled","managed-hosting-patched"],"who_is_affected":"Teams running self-hosted Snipe-IT before 8.7.0 that use encrypted-flagged custom fields on assets and grant API access to users or tokens without the encrypted custom fields permission. Installations that do not use encrypted custom fields or do not expose the API to such users are less exposed. Teams on managed hosting should confirm the vendor has applied the update.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3360,"output_tokens":658,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116198':15A,18A '-2026':14A,17A '8.7.0':31B,92C 'accept':32B 'access':87B,147C 'api':4A,19B,37B,66B,99C,120C 'asset':5A,33B,127C 'assets.view.encrypted':116C 'assetscontrol':100C 'attack':60B 'authent':119C 'backup':82B,142C 'caller':114C 'column':112C 'contain':93C 'creat':126C 'creation':6A,34B 'custom':9A,44B,55B,110C,117C,131C 'custom-field':109C,130C 'cve':13A,16A 'databas':74B,86B,138C,146C 'direct':85B,145C 'encrypt':8A,43B,53B,96C,107C 'encrypted-flag':52B,106C 'expos':139C 'field':10A,45B,56B,111C,118C,132C 'flag':54B,108C 'get':69B 'host':24B 'lack':41B,115C 'low':64B 'low-privileg':63B 'miss':95C 'packag':20B 'permiss':46B,124C 'persist':134C 'php':21B 'plaintext':12A,58B,104C 'privileg':65B 'read':80B 'replica':83B,143C 'save':49B 'self':23B 'self-host':22B 'sensit':70B,129C 'snipe':2A,26B,28B,89C 'snipe-it':1A,25B,27B,88C 'store':7A,101C 'token':67B 'unencrypt':75B,135C 'user':39B,121C 'valu':50B,71B,133C 'vulner':97C 'whose':128C 'without':122C 'write':103C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Snipe-IT before 8.7.0 that use encrypted-flagged custom fields on assets and grant API access to users or tokens without the encrypted custom fields permission. Installations that do not use encrypted custom fields or do not expose the API to such users are less exposed. Teams on managed hosting should confirm the vendor has applied the update.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116198","severity":null,"published_at":"2026-10-25T14:17:00+00:00","modified_at":"2026-10-25T14:17:00+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}