CVE-2026-86757 describes a missing authorization control in Snipe-IT before version 8.7.0. The vulnerability affects encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements. Authenticated users who have permissions such as assets.edit, assets.checkin, assets.checkout, or assets.audit can bypass the assets.view.encrypted_custom_fields permission and read the plaintext of encrypted custom fields by simply opening the asset forms. This indicates a failure to properly gate access to sensitive encrypted data based on user permissions.

The vulnerability allows unauthorized disclosure of encrypted custom field data to users who should not have access, potentially exposing sensitive information stored in asset forms. This could lead to confidentiality breaches within organizations using affected versions of Snipe-IT. The impact is limited to authenticated users with specific asset-related permissions but without explicit permission to view encrypted custom fields.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, organizations should review and restrict permissions for users with assets.edit, assets.checkin, assets.checkout, or assets.audit to minimize exposure. Monitor vendor communications for updates on remediation.