CVE-2026-86753: snipe-it business logic bypass in asset model request endpoint

CVE-2026-86753 · Severity: medium · CVSS 4.3 · Published 2026-09-09

snipe-it is an IT asset management platform that allows employees to request items for checkout. The vulnerability allows authenticated users to bypass administrative restrictions and request asset models that have been explicitly marked as non-requestable. While admins must still approve these requests, attackers can circumvent the policy boundary that prevents certain models from being requested at all, potentially flooding request queues and disabling an administrative control mechanism.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86753 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86753 being exploited in the wild.
How severe is CVE-2026-86753?
Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?
grokability snipe-it before 8.7.0.
Is there a fix for CVE-2026-86753?
A patch was published on 2026-08-24: Fix released in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86753 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86753?
Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a business logic bypass vulnerability in the POST /account/request/asset_model/{modelId} endpoint caused by incomplete authorization checks. The ViewAssetsController::getRequestItem method validates the requestable flag for Asset and Accessory objects before allowing checkout requests, but does not perform the same validation for AssetModel objects, even though an AssetModel::RequestableModels() scope exists. Any authenticated user (no special permissions required) can submit a direct request to the endpoint for a non-requestable model and bypass the administrative restriction. The exploit creates an action log requesting the restricted model, which must still be approved by an admin; the vulnerability does not auto-fulfill checkouts. A secondary issue was patched: the {itemType} route parameter was unconstrained and allowed arbitrary class instantiation. The fix (commit 882d033) adds the AssetModel branch to the authorization gate and constrains the route parameter to asset|asset_model|accessory.

Affected products

  • grokability snipe-it before 8.7.0

Timeline

  • 2026-08-24: disclosed: GitHub Security Advisory GHSA-xmcp-mrw5-cg3g published
  • 2026-09-09: advisory: CVE-2026-86753 published
  • 2026-08-24: patched: Fix released in version 8.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.