PT-2026-89022
CVE-2026-86753
·
تاريخ النشر
2026-09-09
·
تاريخ التحديث
2026-09-14
الوصف من
CVSS 4.0
5.3
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
snipe-it versions prior to 8.7.0
Description
Authenticated users can bypass administrative restrictions to create checkout requests for asset models that are not marked as requestable. This occurs because the application fails to validate the requestable flag when processing requests via the 'POST /account/request/asset model/{modelId}' endpoint.
Recommendations
Update snipe-it to version 8.7.0 or later.
Restrict access to the 'POST /account/request/asset model/{modelId}' endpoint to minimize the risk of unauthorized checkout requests.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾