{"id":"CVE-2026-86753","title":"snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint","summary":"snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests fo…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-863"],"vendor":"snipeitapp","product":"snipe-it","affected":["snipe-it < 8.7.0"],"patched":["snipe-it 8.7.0"],"published":"2026-09-09","updated":"2026-09-14","sourceUpdated":"2026-09-14T20:20:32.003","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86753","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xmcp-mrw5-cg3g","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-business-logic-bypass-via-asset-model-endpoint","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00201,"epssPercentile":0.10352,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T14:27:48.310463Z"},"ingestedAt":"2026-09-09T14:11:29.380Z","slug":"CVE-2026-86753","body":"## Overview\n\nsnipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.\n\n## Affected\n\n- `snipe-it < 8.7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snipe-it 8.7.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}