# CVE-2026-86774: Snipe-IT broken access control in Asset Model file attachments

Source: https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86774 · Severity: medium · CVSS 6.3 · Published 2026-09-09

Snipe-IT is an open-source IT asset management platform used to track and manage company hardware and software inventory. A flaw in its permission system allows employees with basic asset file permissions to upload and delete file attachments on shared Asset Model records without proper authorization, potentially affecting multiple companies on the same installation. This bypasses the intended admin-controlled restrictions on file management for the shared asset model catalog.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86774 being exploited in the wild.

**How severe is CVE-2026-86774?** Medium severity, with a CVSS score of 6.3, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT <8.7.0.

**Is there a fix for CVE-2026-86774?** A patch was published on 2026-09-09: Version 8.7.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86774 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86774?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control (CWE-284, CWE-863) in the AssetModelPolicy::files() method, which cascades permission checks from the routine assets.files permission instead of enforcing the dedicated models.files permission. The policy incorrectly allows write actions (upload, delete) to Asset Model file attachments based on a read permission, because both read and write operations in the UploadedFilesController use the same undifferentiated 'files' ability. Authentication is required (any authenticated user with assets.files permission), but the attack is network-accessible with no user interaction. An attacker can mutate file attachments across company boundaries since Asset Models lack company-scoping. The vulnerability was patched in version 8.7.0 by introducing a separate manageFiles() ability for write actions.

## Affected products

- Snipe-IT Snipe-IT <8.7.0

## Timeline

- 2026-08-24: disclosed: GHSA-rhrf-7x22-x2rj published on GitHub
- 2026-09-09: patched: Version 8.7.0 released with fix
- 2026-09-09: advisory: CVE-2026-86774 and NVD entry published

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-rhrf-7x22-x2rj](https://github.com/grokability/snipe-it/security/advisories/GHSA-rhrf-7x22-x2rj)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-broken-access-control-via-assetmodelpolicy](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-broken-access-control-via-assetmodelpolicy)

## Related threats

- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)
- [Snipe-IT improper ownership management in consumables checkout API](https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout)