Broken Access Control in Snipe-IT Affects File Attachment Management
CVE-2026-86774

5.3MEDIUM

Key Information:

Vendor

Grokability

Status
Snipe-it
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86774?

Snipe-IT versions prior to 8.7.0 are vulnerable to a broken access control issue due to improper permission checks in the AssetModelPolicy. This flaw allows authenticated users with assets.files permission to upload and delete file attachments related to shared Asset Model records without the necessary models.files permission. Consequently, attackers can manipulate shared model file attachments and bypass intended restrictions, raising significant security concerns for organizations managing sensitive asset data.

Affected Version(s)

snipe-it 8.6.3 < 8.7.0

snipe-it 8.7.0

References

https://github.com/grokability/snipe-it/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

adamyordan
.