PT-2026-89022

CVE-2026-86753

Published

2026-09-09

Updated

2026-09-14

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 8.7.0

Description Authenticated users can bypass administrative restrictions to create checkout requests for asset models that are not marked as requestable. This occurs because the application fails to validate the requestable flag when processing requests via the 'POST /account/request/asset model/{modelId}' endpoint.

Recommendations Update snipe-it to version 8.7.0 or later. Restrict access to the 'POST /account/request/asset model/{modelId}' endpoint to minimize the risk of unauthorized checkout requests.

Exploitability

Exploit

Fix

Impacts

Researchers

Pizzastev3

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers

CVE-2026-86753