CVE-2026-86767 is a vulnerability in grokability's Snipe-IT asset management software where versions prior to 8.7.0 fail to enforce company scope filtering on the GET /hardware/requested API endpoint when Full Multiple Company Support is enabled. Authenticated users with the assets.view permission can retrieve pending asset requests belonging to other companies, exposing sensitive information including requested asset names, requester display names and profile links, locations, and expected check-in dates. This exposure occurs without the need for parameter manipulation.

The vulnerability allows unauthorized access to sensitive asset request information across company boundaries within the same Snipe-IT instance. This could lead to information disclosure of asset details and user information to authenticated users who should only have access to their own company's data. There is no indication of privilege escalation or remote unauthenticated exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 8.7.0, upgrading to version 8.7.0 or later is likely to address the issue once an official fix is released. Until then, restrict assets.view permissions carefully and consider disabling Full Multiple Company Support if feasible.