CVE-2026-116198— Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Quick assessment

Affected

grokability snipe-it

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snipe-IT 8.7.0 之前的版本在方法中存在加密缺失漏洞：当调用者未拥有权限时，该方法会将明文数据写入被标记为“已加密”的自定义字段列中。拥有该 API 访问权限但缺乏上述特定权限的用户，可创建包含敏感自定义字段值的资产，而这些值将以明文形式持久化存储于数据库中，从而可能通过数据库备份、副本或直接数据库访问等方式泄露。

CVSS 4.3 · Medium Updated Oct 25, 2026

Possible ATT&CK Techniques 1 AI

T1552 · Unsecured Credentials

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Source: CVE Program / CVE List V5

Vulnerability Description

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

敏感数据加密缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
grokability	snipe-it	0 ~ 8.7.0	-

II. Public POCs for CVE-2026-116198

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116198

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-116198 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116198

Same Patch Batch · grokability · 2026-10-25 · 4 CVEs total

CVE-2026-116201	8.8 HIGH	Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition
CVE-2026-116199	8.1 HIGH	Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
CVE-2026-116200	5.9 MEDIUM	Snipe-IT before 8.6.3 LDAP StartTLS Downgrade via connectToLdap()

IV. Related Vulnerabilities

Same product: snipe-it

Same vendor: grokability

Same weakness: CWE-311