CVE-2026-86774: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86774 Overview

CVE-2026-86774 is a broken access control vulnerability in Snipe-IT versions before 8.7.0. The flaw resides in the AssetModelPolicy class, where the files() method incorrectly cascades permissions from assets.files instead of enforcing the dedicated models.files permission. Authenticated users with only the assets.files permission can upload and delete file attachments on shared Asset Model records. The issue affects the shared Asset Model catalog and enables attackers to mutate model file attachments across company boundaries in multi-tenant deployments.

Critical Impact
Authenticated users can bypass the models.files permission boundary to upload and delete file attachments on Asset Model records, potentially impacting shared catalog data across tenants.

Affected Products

Snipe-IT versions prior to 8.7.0
Snipe-IT open-source IT asset management application
Multi-tenant deployments sharing the Asset Model catalog

Discovery Timeline

2026-09-09 - CVE-2026-86774 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86774

Vulnerability Analysis

Snipe-IT enforces authorization through Laravel policy classes that map user permissions to model actions. The AssetModelPolicy class governs actions on Asset Model records, including the ability to manage file attachments. The files() policy method, which should require the models.files permission, instead evaluates the assets.files permission. This cascading logic conflates two distinct permission scopes: file attachments on individual Asset records and file attachments on the shared Asset Model catalog.

The result is a permission boundary bypass classified as broken access control [CWE-284]. Any authenticated user granted assets.files inherits the ability to modify Asset Model attachments, even if administrators deliberately withheld models.files. In multi-tenant Snipe-IT instances, Asset Models are shared across companies, so a low-privileged user in one company boundary can alter shared model attachments visible to other tenants.

Root Cause

The root cause is an authorization policy defect in AssetModelPolicy::files(). The method delegates to the assets.files permission check rather than the intended models.files permission. This design flaw removes the separation between per-asset file management and catalog-level model file management.

Attack Vector

An attacker requires an authenticated Snipe-IT account with assets.files permission. Using the standard web interface or API endpoints for Asset Model file operations, the attacker submits upload or delete requests targeting model attachments. The policy incorrectly authorizes the request, allowing the attacker to add malicious files or remove legitimate documentation from the shared catalog.

No verified exploit code has been published for this vulnerability. Refer to the GitHub Security Advisory GHSA-rhrf-7x22-x2rj for technical details.

Detection Methods for CVE-2026-86774

Indicators of Compromise

Unexpected file uploads or deletions on Asset Model records performed by users lacking the models.files permission
Audit log entries showing model attachment mutations originating from accounts with only assets.files permission
New or removed files in the Snipe-IT storage path associated with Asset Model IDs

Detection Strategies

Review Snipe-IT activity logs for AssetModel file upload and delete events correlated with user permission sets
Alert on policy authorization events where the acting user does not hold models.files but successfully mutated model attachments
Compare Asset Model attachment inventories against known-good baselines to identify unauthorized changes

Monitoring Recommendations

Enable and forward Snipe-IT application logs to a centralized SIEM for correlation across tenants
Monitor HTTP requests to Asset Model file endpoints and track the requesting user's permission profile
Track cross-company modifications to shared Asset Model records in multi-tenant deployments

How to Mitigate CVE-2026-86774

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which corrects the AssetModelPolicy::files() permission check
Audit user permission assignments and revoke assets.files from accounts that do not require file management capabilities
Review Asset Model attachments for unauthorized additions or deletions performed prior to patching

Patch Information

The vendor released a fix in Snipe-IT 8.7.0. Details are available in the GitHub Security Advisory GHSA-rhrf-7x22-x2rj and the VulnCheck Advisory on Snipe-IT. Administrators should apply the update through their standard Snipe-IT deployment process.

Workarounds

Restrict assets.files permission to trusted administrators until the upgrade is applied
Isolate multi-tenant Snipe-IT instances or disable shared Asset Model workflows where feasible
Implement web application firewall rules to block unauthorized requests to Asset Model file endpoints

bash

# Upgrade Snipe-IT to a patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear