Executive brief
snipe-it is an IT asset management platform that allows employees to request items for checkout. The vulnerability allows authenticated users to bypass administrative restrictions and request asset models that have been explicitly marked as non-requestable. While admins must still approve these requests, attackers can circumvent the policy boundary that prevents certain models from being requested at all, potentially flooding request queues and disabling an administrative control mechanism.
Technical details
This is a business logic bypass vulnerability in the POST /account/request/asset_model/{modelId} endpoint caused by incomplete authorization checks. The ViewAssetsController::getRequestItem method validates the requestable flag for Asset and Accessory objects before allowing checkout requests, but does not perform the same validation for AssetModel objects, even though an AssetModel::RequestableModels() scope exists. Any authenticated user (no special permissions required) can submit a direct request to the endpoint for a non-requestable model and bypass the administrative restriction. The exploit creates an action log requesting the restricted model, which must still be approved by an admin; the vulnerability does not auto-fulfill checkouts. A secondary issue was patched: the {itemType} route parameter was unconstrained and allowed arbitrary class instantiation. The fix (commit 882d033) adds the AssetModel branch to the authorization gate and constrains the route parameter to asset|asset_model|accessory.
Affected products
- grokability snipe-it before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-xmcp-mrw5-cg3g published
- 2026-09-09: advisory: CVE-2026-86753 published
- 2026-08-24: patched: Fix released in version 8.7.0