CVE-2026-86737 describes a missing authorization control in the snipe-it asset management software prior to version 8.7.0. Specifically, the GET /hardware/{asset}/barcode endpoint does not enforce asset view authorization, enabling authenticated attackers with limited privileges to iterate over asset IDs and retrieve barcode information. This flaw allows enumeration of asset tags across different tenants, including assets that are soft-deleted or belong to other companies, potentially exposing sensitive asset information.

The vulnerability allows authenticated users with limited privileges to bypass authorization controls and access barcode data for assets they should not be able to view. This can lead to unauthorized disclosure of asset information across tenants and companies, including soft-deleted assets. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and monitor for unusual asset enumeration activity. Follow vendor updates closely for a forthcoming patch or official remediation instructions.