# CVE-2026-86773: Snipe-IT broken access control in Predefined Kit endpoints

Source: https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86773 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Snipe-IT is an IT asset management platform used by organizations to track hardware, software licenses, and consumables. An authenticated user with limited permissions (kits.edit only) can attach licenses, consumables, or accessories they should not be able to access to a Predefined Kit, and then retrieve the names of those restricted objects. While this does not corrupt the objects themselves, it allows unauthorized information disclosure and unintended data associations.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86773 being exploited in the wild.

**How severe is CVE-2026-86773?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT through 8.6.3.

**Is there a fix for CVE-2026-86773?** A patch was published on 2026-09-09: Fixed in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86773 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86773?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue (CWE-863) in five API endpoints: updateLicense, updateConsumable, updateAccessory, updateModel, and storeModel in PredefinedKitsController.php. These endpoints perform authorization only on the parent Predefined Kit (via $this->authorize('update', PredefinedKit::class)) but fail to authorize the child object (license, consumable, accessory, or asset model) being attached via syncWithoutDetaching or attach. An authenticated user with kits.edit permission can thus attach restricted objects without ever fetching or authorizing them, and the kit relation index then leaks the attached object's name back to the user. No user interaction is required; exploitation occurs over the network via HTTP PUT/POST requests. The updateModel endpoint was further unreachable due to a route typo but contained the same authorization flaw. The vulnerability is fixed in Snipe-IT 8.7.0.

## Affected products

- Snipe-IT Snipe-IT through 8.6.3

## Timeline

- 2026-09-09: disclosed
- 2026-09-09: patched: Fixed in version 8.7.0

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w](https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w)
- [https://www.vulncheck.com/advisories/snipe-it-8.6.3-broken-access-control-via-kit-update-endpoints](https://www.vulncheck.com/advisories/snipe-it-8.6.3-broken-access-control-via-kit-update-endpoints)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)
- [Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout)