Snipe‑IT is an IT asset and license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint lacks an authorization check (CWE‑862: Missing Authorization). Any user who can log into Snipe‑IT—regardless of permissions—can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. The response exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and for the users within the same company if FMCS is enabled. This allows information disclosure that could assist credential‑based attacks but does not provide code execution or direct system control. Version 8.6.1 contains a patch.

Snipe‑IT, an IT asset and license management system developed by grokability, is affected. All releases prior to version 8.6.1 expose the insecure endpoint; upgrading to 8.6.1 or later resolves the issue.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The attack vector is likely an authenticated web session; any user who can log into Snipe‑IT can exploit the endpoint without needing an API token or elevated permissions. If the company‑finder‑by‑company‑search (FMCS) feature is disabled, the full user base the user’s company are revealed.