CVE-2026-86773: Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints
Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit (update on PredefinedKit) and not the child object being attached. As a result, an authenticated user holding only the kits.edit permission can attach a License, Consumable, Accessory, or Asset Model that they are otherwise denied (HTTP 403) from reading directly to a Predefined Kit, and the kit relation index then discloses the attached object's name back to that low-privilege user. This is the update-path and storeModel counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2. Note that updateModel was code-vulnerable in 8.6.3 but not reachable in practice because a route-name typo bound the route to a nonexistent controller method, causing HTTP 500 responses. The issue is fixed in Snipe-IT 8.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-55478
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the kits.edit permission can exploit it, even if they are denied direct read access to the License, Consumable, Accessory, or Asset Model being attached.
What information can the affected user obtain?
After attaching an otherwise inaccessible child object to a Predefined Kit, the user can view that object's name through the kit relation index. The stated impact is limited to low confidentiality and integrity impact, with no availability impact.
Are all of the identified endpoint paths practically exploitable in version 8.6.3?
The updateLicense, updateConsumable, updateAccessory, and storeModel paths are affected. Although updateModel was vulnerable in code, it was not reachable in practice in 8.6.3 because a route-name typo caused HTTP 500 responses.
What version resolves the issue?
The issue is fixed in Snipe-IT 8.7.0. The earlier 8.6.2 fix addressed only the storeLicense, storeConsumable, and storeAccessory methods, not the update-path and storeModel issues described here.