CVE-2026-116198

Published: Ott 25, 2026 Last Modified: Ott 25, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM 4,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: none

Description

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

311

Missing Encryption of Sensitive Data

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity
Potential Impacts:
Read Application Data Modify Application Data
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/grokability/snipe-it/security/advisories…
https://github.com/grokability/snipe-it/security/advisories/GHSA-jh4g-98fm-jcqc
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-…
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-encryption-v…