Snipe‑IT is an IT asset and license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check (CWE‑862). Any user who can log into Snipe‑IT—regardless of permissions—can retrieve a paginated list of all user accounts using only their web session cookie. No API token or elevated permissions are required. The response exposes usernames, display names, employee numbers, and user IDs for every active account in the system if FMCS is not enabled, and within the company they belong to if FMCS is enabled. This allows information disclosure that could assist credential‑based attacks but does not provide code execution or direct system control. Version 8.6.1 contains a patch.

Snipe‑IT, an IT asset and license management system developed by grokability, is affected. All releases prior to version 8.6.1 expose the insecure endpoint; upgrading to 8.6.1 or later resolves the issue.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is an authenticated web session; any user who can log into Snipe‑IT can exploit the endpoint without needing an API token or elevated permissions. If the company‑finder‑by‑company‑search (FMCS) feature is disabled, the full user base the user’s company are revealed.