| Package | Affected versions | Patched versions |
|---|---|---|
| snipe-it | < 8.7.0 | 8.7.0 |
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypted_custom_fields. Authenticated API users without that permission can create assets whose sensitive custom-field values persist unencrypted in the database, exposing them through backups, replicas, or direct database access.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free