https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T05:43:08.501066+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-84206 CVE-2026-84206 — Snipe-IT before 8.7.0 Authorization Bypass via Bulk Restore 2026-10-01T05:43:08.502430+00:00

Affected: grokability snipe-it

Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation.