Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck
CVE-2026-86773Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Medium 5.4
In plain English
A medium-severity incorrect authorization in snipe-it from grokability. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| grokability | snipe-it | 8.6.3 – before 8.7.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-4j5f-mm59-hf9w) vendor-advisory
- VulnCheck Advisory: Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints third-party-advisory