The vulnerability in snipe-it prior to version 8.7.0 arises from improper authorization checks on asset audit endpoints. Instead of enforcing authorization at the policy layer, the system relies solely on query-layer filtering to restrict access by instance scope. This design flaw permits attackers who have valid sessions and the assets.audit permission to potentially write audit log entries for assets outside their authorized company scope if the query-layer filtering is circumvented or modified.

An attacker with valid credentials and assets.audit permissions can write audit log entries against assets belonging to other companies. This could lead to unauthorized modification of audit logs, potentially impacting data integrity and audit reliability. There is no indication of privilege escalation beyond the assets.audit permission or direct data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict assets.audit permissions to trusted users only and monitor for unusual audit log activity related to cross-company asset entries.