CVE-2026-86773: Snipe-IT Privilege Escalation Vulnerability

CVE-2026-86773 Overview

CVE-2026-86773 is a broken access control vulnerability in Snipe-IT through version 8.6.3. The flaw resides in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints, and in the storeModel endpoint for Predefined Kits. The authorization check validates permissions on the parent Predefined Kit but skips object-level authorization on the child resource being attached. An authenticated user holding only the kits.edit permission can attach Licenses, Consumables, Accessories, or Asset Models they cannot otherwise read. The kit relation index then leaks the attached object's name to the low-privilege user. This weakness is classified as [CWE-863: Incorrect Authorization]. The issue is fixed in Snipe-IT 8.7.0.

Critical Impact
Authenticated users with only kits.edit permission can bypass object-level authorization to attach and enumerate the names of Licenses, Consumables, Accessories, and Asset Models they are forbidden (HTTP 403) from reading directly.

Affected Products

Snipe-IT versions up to and including 8.6.3
Snipe-IT 8.6.2 (partially fixed for store* methods via CVE-2026-55478, but update-path remained vulnerable)
Snipe-IT Predefined Kit management endpoints

Discovery Timeline

2026-09-09 - CVE-2026-86773 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86773

Vulnerability Analysis

Snipe-IT implements Predefined Kits as a bundling mechanism for Licenses, Consumables, Accessories, and Asset Models. The updateLicense, updateConsumable, updateAccessory, updateModel, and storeModel controller methods handle attaching these child resources to a parent kit. Each of these methods performs an authorization check exclusively against the parent PredefinedKit object using the kits.edit permission.

The controllers omit a corresponding authorization check on the child object referenced in the request payload. A user who cannot view or edit a specific License in the standard interface can still reference that License by its ID when updating a Predefined Kit. The response then includes the attached object's name via the kit's relation index, disclosing data the user is not permitted to read directly.

This flaw is the update-path counterpart to CVE-2026-55478, which addressed the storeLicense, storeConsumable, and storeAccessory methods in version 8.6.2 but left the update handlers unpatched. Note that updateModel was code-vulnerable in 8.6.3 but not exploitable in practice because a route-name typo bound the route to a nonexistent controller method, producing HTTP 500 responses.

Root Cause

The root cause is missing object-level authorization on child resources during kit-composition operations. The existing policy check only validates update on PredefinedKit, not view or update on the attached child model. This is a classic [CWE-863] pattern where authorization scope is too narrow relative to the operation's data footprint.

Attack Vector

The attack requires an authenticated session with the kits.edit permission. The attacker sends a crafted HTTP request to a vulnerable kit update or storeModel endpoint, referencing a target License, Consumable, Accessory, or Asset Model ID. The server attaches the resource to the kit and returns a response that discloses the target object's name, enabling enumeration of restricted resources by iterating IDs.

See the GitHub Security Advisory and the VulnCheck Advisory for Snipe-IT for endpoint-level detail.

Detection Methods for CVE-2026-86773

Indicators of Compromise

Successful HTTP requests to kit update endpoints (/api/v1/kits/*/licenses, /consumables, /accessories, /models) from accounts that lack read permission on the referenced child resources.
Audit log entries showing users with only kits.edit permission modifying kit contents containing sensitive Licenses or Asset Models.
High-volume sequential ID enumeration against Predefined Kit endpoints suggesting resource discovery.

Detection Strategies

Correlate application-layer access logs with the Snipe-IT permissions model to identify requests where the acting user holds kits.edit but not the corresponding licenses.view, consumables.view, accessories.view, or models.view permission.
Alert on Predefined Kit modifications that reference child object IDs never previously accessed by the acting user.

Monitoring Recommendations

Ingest Snipe-IT web server and application logs into a centralized log platform and retain them for at least 90 days.
Monitor for HTTP 500 responses on updateModel routes, which indicate probing activity related to the route-name typo referenced in the advisory.
Track anomalous growth in Predefined Kit relation counts as an indicator of automated enumeration.

How to Mitigate CVE-2026-86773

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which contains the object-level authorization fix.
Audit all accounts holding the kits.edit permission and remove it from users who do not require kit-composition capabilities.
Review recent Predefined Kit modifications for unexpected attachments of Licenses, Consumables, Accessories, or Asset Models.

Patch Information

The vulnerability is fixed in Snipe-IT 8.7.0. Refer to the GitHub Security Advisory GHSA-4j5f-mm59-hf9w for patch commit references and upgrade guidance.

Workarounds

Restrict the kits.edit permission to a minimal set of trusted administrators until the upgrade is completed.
Place the Snipe-IT application behind a web application firewall (WAF) with rules that inspect kit update payloads for cross-tenant object references.
Disable or block access to Predefined Kit update endpoints at the reverse proxy if kit management is not actively required.

bash

# Example nginx rule to block kit update endpoints as a temporary mitigation
location ~ ^/api/v1/kits/[0-9]+/(licenses|consumables|accessories|models) {
    if ($request_method ~ ^(PUT|PATCH|POST)$) {
        return 403;
    }
}