CVE-2026-86773

Undergoing Analysis Undergoing Analysis - In Progress

Authorization Bypass in Snipe-IT via Object-Level Access

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86773

EUVD

EUVD-2026-74950

Affected Vendors & Products

Vendor	Product	Version / Range
snipeit	snipeit	to 8.7.0 (exc)
snipeit	snipeit	8.7.0
grokability	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	8.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

CVE-2026-86773 is a Broken Access Control vulnerability in Snipe-IT versions 8.6.3 and earlier. It allows an authenticated user with only the kits.edit permission to attach restricted objects like Licenses, Consumables, Accessories, or Asset Models to a Predefined Kit without proper authorization. The system fails to check object-level permissions, letting unauthorized users attach these objects and leak their names through the kit relation index.

The vulnerability affects five endpoints: updateLicense, storeModel, updateModel, updateConsumable, and updateAccessory. A patch was released in version 8.7.0 to fix this issue.

Detection Guidance

To detect this vulnerability, check if your Snipe-IT instance is running version 8.6.3 or earlier. Verify if users with kits.edit permission can access restricted objects through the affected endpoints: updateLicense, updateConsumable, updateAccessory, updateModel, and storeModel. Monitor for unauthorized attachments of Licenses, Consumables, Accessories, or Asset Models to Predefined Kits.

Impact Analysis

This vulnerability allows low-privilege users to indirectly access restricted objects by attaching them to a Predefined Kit. While direct access to these objects is blocked, their names are disclosed through the kit relation index. This could lead to unauthorized exposure of sensitive data like Licenses or Asset Models.

The impact includes potential data leakage and unauthorized access to sensitive information, even though direct read permissions are restricted. Users should upgrade to version 8.7.0 or revoke kits.edit permissions as a temporary fix.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data, such as Licenses or Asset Models, which may contain personal or confidential information. Data leakage through the kit relation index violates principles of least privilege and data protection.

Organizations using Snipe-IT must address this issue to maintain compliance with GDPR's data protection requirements and HIPAA's safeguards for protected health information. Upgrading to version 8.7.0 is recommended to mitigate risks.

Mitigation Strategies

Immediately upgrade Snipe-IT to version 8.7.0 or later to apply the patch. As a temporary workaround, revoke the kits.edit permission from users who do not require it. Ensure proper object-level authorization checks are enforced on all affected endpoints.

Hi! I’m here to help you understand CVE-2026-86773. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70