CVE-2026-86761 is an authorization bypass vulnerability affecting snipe-it versions prior to 8.7.0. The flaw exists in the location print endpoints, which do not enforce per-model authorization checks. This allows authenticated attackers who have location view permission to access the printassigned and printallassigned endpoints and retrieve information related to users, assets, accessories, consumables, and components regardless of their individual model permissions.

An attacker with authenticated access and location view permission can bypass intended authorization restrictions to access sensitive information across multiple models. This could lead to unauthorized disclosure of asset management data including users, assets, accessories, consumables, and components. The vulnerability does not require elevated privileges beyond location view permission and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates and consider restricting location view permissions to trusted users until a fix is available.