CVE-2026-86743 is an authorization bypass vulnerability in grokability's Snipe-IT asset management software. Versions prior to 8.7.0 do not properly restrict asset acceptance report queries by company, allowing users with reports.view privileges to access unaccepted asset reports and CSV exports beyond their authorized company scope. This results in unauthorized disclosure of cross-company inventory and assignee information due to missing per-row access validation.

Authenticated users with reports.view permission can access sensitive asset acceptance data from all companies managed in the system, potentially exposing confidential inventory and personnel assignment information. There is no indication of privilege escalation or remote unauthenticated exploitation. The impact is limited to information disclosure within the scope of authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict reports.view permissions to trusted users only and monitor access to asset acceptance reports to limit exposure.