---
id: CVE-2026-86753
title: >-
  snipe-it versions before 8.7.0 fail to validate the requestable flag for asset
  models in the POST /account/request/asset_model/{modelId} endpoint
summary: >-
  snipe-it versions before 8.7.0 fail to validate the requestable flag for asset
  models in the POST /account/request/asset_model/{modelId} endpoint.
  Authenticated users can bypass administrative restrictions and create checkout
  requests fo…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:20:32.003'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86753'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-xmcp-mrw5-cg3g
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-business-logic-bypass-via-asset-model-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0028
epssPercentile: 0.18156
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:27:48.310463Z'
ingestedAt: '2026-09-09T14:11:29.380Z'
---

## Overview

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`