CVE-2026-86774CWE-284broken-access-control

CVE-2026-86774

Medium · published September 9, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-09-09T18:17Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (2)
https://github.com/grokability/snipe-it/security/advisories/GHSA-rhrf-7x22-x2rj · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-broken-access-control-via-assetmodelpolicy · [email protected]
EPSS history
Timeline
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:32Z
    Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy
    cvelistv5