---
id: CVE-2026-86773
title: >-
  Snipe-IT through version 8.6.3 fails to perform object-level authorization in
  the updateLicense, updateConsumable, updateAccessory, and updateModel
  endpoints and in the storeModel endpoint for Predefined Kits
summary: >-
  Snipe-IT through version 8.6.3 fails to perform object-level authorization in
  the updateLicense, updateConsumable, updateAccessory, and updateModel
  endpoints and in the storeModel endpoint for Predefined Kits. The existing
  check authoriz…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-863
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:23:42.817'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86773'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-8.6.3-broken-access-control-via-kit-update-endpoints
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-4j5f-mm59-hf9w
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.0025
epssPercentile: 0.14567
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:32:19.102793Z'
ingestedAt: '2026-09-14T04:39:22.773Z'
---

## Overview

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`