---
id: CVE-2026-86774
title: >-
  Snipe-IT versions before 8.7.0 contain a broken access control vulnerability
  in AssetModelPolicy where the files() method cascades from assets.files
  permission, allowing authenticated users to upload and delete file attachments
  on Asset …
summary: >-
  Snipe-IT versions before 8.7.0 contain a broken access control vulnerability
  in AssetModelPolicy where the files() method cascades from assets.files
  permission, allowing authenticated users to upload and delete file attachments
  on Asset …
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-284
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T01:16:31.293'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86774'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-rhrf-7x22-x2rj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-broken-access-control-via-assetmodelpolicy
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-20T00:07:42.738724Z'
epss: 0.00285
epssPercentile: 0.18636
ingestedAt: '2026-09-10T20:26:11.117Z'
---

## Overview

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`