CVE-2026-86753 in Snipe-ITinfo

Summary

by MITRE • 09/09/2026

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

09/08/2026

Disclosure

09/09/2026

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

very low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-86753
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-86753
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-86753/

◂ PreviousOverviewNext ▸

Want to know what is going to be exploited?

We predict KEV entries!