CVE-2026-86753 — snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass…
Published: 2026-09-09 · CVSS: 5.3 · CVSS 4.0
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7