CVE-2026-86753: snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Configuration
Ensure the application validates the asset model's requestable flag for POST requests to /account/request/asset_model/{modelId} (vulnerable behavior exists in versions before 8.7.0, where the requestable flag is not validated).
Snipe-IT asset_model endpoint (POST /account/request/asset_model/{modelId}) requestable flag validation = true
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Snipe-IT user can exploit it. No user interaction is required, but the attacker must be able to submit a request to the affected asset-model request endpoint.
What restrictions can be bypassed?
The endpoint does not validate whether the targeted asset model is marked requestable. A user can therefore create a checkout request for an asset model that administrators have configured as non-requestable.
Are default installations affected?
The provided information does not establish whether the default configuration includes non-requestable asset models. Exposure depends on having an affected version and asset models for which administrators rely on the requestable flag to prevent requests.
How can administrators identify possible exploitation?
Review checkout requests for asset models marked non-requestable, particularly requests created through the asset-model request workflow. The available data does not provide specific log fields or indicators for distinguishing direct endpoint submissions.