CVE-2026-86774

Undergoing Analysis Undergoing Analysis - In Progress

Broken Access Control in Snipe-IT Before 8.7.0

Publication date: 2026-09-09

Last updated on: 2026-09-20

Assigner: VulnCheck

Description

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-20

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86774

EUVD

EUVD-2026-74951

Affected Vendors & Products

Vendor	Product	Version / Range
snipe-it	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-86774 is a broken access control vulnerability in Snipe-IT versions before 8.7.0. It allows authenticated users with only the assets.files permission to upload and delete file attachments on Asset Model records without needing the models.files permission. This happens because the AssetModelPolicy::files() method incorrectly grants write access through a read permission cascade.

Detection Guidance

Check Snipe-IT version with: grep -r "version" config/app.php. If version is below 8.7.0, the system is vulnerable. Review user permissions for assets.files and models.files in the database or admin panel.

Impact Analysis

Attackers could modify or delete shared model file attachments across company boundaries, even if they only have limited permissions. This could lead to unauthorized changes in asset records, data corruption, or loss of critical model files. The integrity impact is high as attackers can arbitrarily upload or delete files in the shared model catalog.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by allowing unauthorized users to modify or delete file attachments in the shared Asset Model catalog. Unauthorized file changes may lead to data integrity issues, potential exposure of sensitive information, or violations of access control requirements mandated by these regulations.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. As a temporary workaround, revoke the assets.files permission from non-admin users until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-86774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70