{"id":"CVE-2026-116198","title":"Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store","summary":"Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API u…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-311"],"vendor":"grokability","product":"snipe-it","affected":["snipe-it < 8.7.0"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T13:20:31.140Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116198","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-jh4g-98fm-jcqc","label":"GitHub Security Advisory (GHSA-jh4g-98fm-jcqc)"},{"url":"https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-encryption-via-api-assetscontroller-store","label":"VulnCheck Advisory: Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.940Z","epss":0.00077,"epssPercentile":0.00106,"slug":"CVE-2026-116198","body":"## Overview\n\nSnipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.\n\n## Affected\n\n- `snipe-it < 8.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}