Incorrect authorization in snipe-it - CVE-2026-86773
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU145114
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-86773
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify data associations.
The vulnerability exists due to incorrect authorization in PredefinedKitsController update and storeModel endpoints when handling requests to attach licenses, consumables, accessories, or asset models to predefined kits. A remote user can send a specially crafted request referencing an object they cannot directly read to disclose sensitive information and modify data associations.
The relation index leaks the attached object's name back to the caller, and no user interaction is required.
Affected software
snipe-it
How to mitigate CVE-2026-86773
Install security update from vendor's website.
snipe-it - update to 8.7.0