CVE-2026-86735 is a SSRF vulnerability in snipe-it before version 8.7.0. The vulnerability arises because the ExternalUrl validation rule does not properly detect IPv6 transition addresses that map to private IPv4 addresses. This allows attackers who have super-admin privileges to set webhook URLs using IPv6 transition mechanisms such as NAT64, 6to4, or Teredo. By doing so, they can bypass SSRF protections and make the server send requests to internal network services or cloud metadata endpoints that should be inaccessible, potentially exposing sensitive information or enabling further attacks.

An attacker with super-admin privileges can exploit this vulnerability to bypass SSRF protections and access internal services or cloud metadata endpoints. This could lead to unauthorized information disclosure or further compromise of internal infrastructure. The CVSS 4.0 base score is 5.9, indicating a medium severity impact with network attack vector, high complexity, and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. Until a fix is available, restrict super-admin privileges to trusted users and carefully validate any webhook URL configurations to prevent use of IPv6 transition addresses.