CVE-2026-86753: Snipe-IT Authentication Bypass Vulnerability

CVE-2026-86753 Overview

CVE-2026-86753 affects Snipe-IT, an open-source IT asset management application, in all versions before 8.7.0. The vulnerability resides in the POST /account/request/asset_model/{modelId} endpoint, which fails to validate the requestable flag on asset models. Authenticated users can submit requests directly to the endpoint and create checkout requests for asset models that administrators marked as non-requestable. The flaw is categorized as an authorization weakness [CWE-863] and represents a business logic bypass rather than a memory-safety issue.

Critical Impact
Authenticated Snipe-IT users can bypass administrative restrictions and submit checkout requests for asset models the organization explicitly configured as non-requestable, undermining asset governance workflows.

Affected Products

Snipe-IT versions prior to 8.7.0
Self-hosted Snipe-IT deployments exposing the /account/request/asset_model/ endpoint
Any Snipe-IT instance permitting authenticated user sessions

Discovery Timeline

2026-09-09 - CVE-2026-86753 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86753

Vulnerability Analysis

Snipe-IT allows administrators to mark asset models as requestable or non-requestable, controlling which items end users can request through the self-service portal. The POST /account/request/asset_model/{modelId} endpoint accepts a model identifier and creates a checkout request associated with the authenticated user. In versions before 8.7.0, the endpoint does not check whether the target asset model has the requestable flag enabled before creating the request. An authenticated user can therefore issue the request directly, bypassing the user interface controls that hide non-requestable models. The condition maps to CWE-863 (Incorrect Authorization) because the server performs the action without validating that the resource is permitted for the operation.

Root Cause

The request-handling logic authorizes the caller based on session state and the presence of a valid model identifier. It omits a server-side check on the requestable attribute of the referenced asset model. Client-side filtering in the user interface hides non-requestable models from listings, but the endpoint itself relies on that filtering to enforce policy, producing a classic broken access control pattern.

Attack Vector

Exploitation requires an authenticated Snipe-IT account with standard user privileges and network access to the application. An attacker enumerates or guesses valid asset model identifiers, then issues a direct HTTP POST to /account/request/asset_model/{modelId} with the target model's ID. The server accepts the request and records a checkout request for a model that administrators intended to keep off-limits. No elevated privileges, user interaction, or complex preconditions are required beyond an active session.

No public proof-of-concept code is currently available. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for additional technical detail.

Detection Methods for CVE-2026-86753

Indicators of Compromise

Checkout requests recorded in Snipe-IT for asset models where the requestable flag is set to false.
HTTP POST requests to /account/request/asset_model/{modelId} originating from users who could not have discovered the model through the standard UI listings.
Unusual volumes of asset requests from a single authenticated account across many distinct model IDs, suggesting enumeration.

Detection Strategies

Query the Snipe-IT database for checkout_requests joined against models where requestable = 0, and alert on any resulting rows.
Enable web server or reverse proxy access logging for the /account/request/asset_model/ path and correlate request paths against the current set of requestable models.
Review Snipe-IT audit logs for request creation events tied to models never exposed in the self-service catalog.

Monitoring Recommendations

Forward Snipe-IT application and web server logs to a centralized logging platform for retention and search.
Build alerts on repeated POST requests to /account/request/asset_model/ with sequentially incrementing model IDs from the same session or IP.
Track version banners and deployed release strings to identify Snipe-IT instances still running versions below 8.7.0.

How to Mitigate CVE-2026-86753

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later on all production and staging instances.
Audit existing checkout requests for entries tied to non-requestable asset models and reverse any unauthorized approvals.
Review user accounts and rotate credentials for any accounts observed exploiting the endpoint.

Patch Information

The maintainers addressed the issue in Snipe-IT 8.7.0 by adding server-side validation of the requestable flag on the target asset model before processing the checkout request. Full remediation details are documented in the GitHub Security Advisory GHSA-xmcp-mrw5-cg3g.

Workarounds

Restrict network access to the Snipe-IT application to trusted administrative users while planning the upgrade.
Configure a reverse proxy or web application firewall rule to block POST requests to /account/request/asset_model/{modelId} where {modelId} is not present in an allowlist of currently requestable model IDs.
Temporarily reduce the number of authenticated end-user accounts with access to the self-service portal until the patched version is deployed.

bash

# Example NGINX rule blocking direct POSTs to the affected endpoint
location ~ ^/account/request/asset_model/[0-9]+$ {
    if ($request_method = POST) {
        return 403;
    }
    proxy_pass http://snipe_it_backend;
}