CVE-2026-86758 describes a vulnerability in Snipe-IT prior to version 8.7.0 where the viewKeys authorization gate is not properly enforced on CSV export and API index endpoints. Authenticated users granted only the licenses.view permission can exploit this to access product license keys, which should require the more privileged viewKeys permission. This flaw enables bulk extraction of license keys via CSV export and allows attackers to confirm valid keys by observing differences in API responses, effectively bypassing intended access controls.

The vulnerability allows unauthorized access to sensitive license keys by users with limited permissions, potentially leading to unauthorized use or distribution of software licenses. This exposure compromises confidentiality of license data and could facilitate further attacks or license misuse. There is no indication of privilege escalation beyond license key access or system compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions carefully to avoid granting licenses.view permission to untrusted users. Monitor vendor channels for updates regarding a patch or official remediation.