CVE-2026-86774 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical failure in access control logic within the application's policy layer, specifically affecting the AssetModelPolicy component. This flaw stems from an improper implementation of permission inheritance where the files() method incorrectly cascades permissions from the assets.files scope to operations on asset models. In a properly secured system, distinct resource types such as individual assets and shared asset model definitions should maintain separate authorization boundaries to prevent privilege escalation or lateral movement across different data domains. The current design allows authenticated users who possess only the assets.files permission to execute file management actions on Asset Model records, effectively bypassing the dedicated models.files permission that is intended to restrict access to this specific catalog of shared resources.
From a technical perspective, the root cause lies in the logic governing how permissions are evaluated for asset model operations. When an authenticated user attempts to upload or delete file attachments associated with an Asset Model record, the system checks against the assets.files permission rather than enforcing the stricter models.files requirement. This misconfiguration creates a broken access control scenario where the principle of least privilege is violated. Users who should be limited to managing files attached to individual asset instances are granted elevated privileges that allow them to modify metadata and attachments on shared model definitions. This bypass mechanism undermines the intended security architecture, which relies on granular permission sets to isolate different operational contexts within the inventory management system.
The operational impact of this vulnerability is significant for organizations utilizing Snipe-IT as a centralized asset tracking solution. Attackers with compromised accounts or malicious insiders possessing only assets.files permissions can mutate shared model file attachments across company boundaries. This capability allows them to inject unauthorized content, such as malware-laden documents or phishing links, into the metadata that defines how certain types of hardware are managed. Furthermore, the ability to delete these attachments disrupts operational continuity and data integrity for other users who rely on accurate asset model information. The cross-boundary nature of this attack means that a user restricted in one department can potentially affect resources visible to or used by other departments, leading to potential security incidents stemming from compromised attachment files or loss of critical configuration data associated with asset models.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges that they are not authorized to have through a logic flaw rather than a direct exploitation of a buffer overflow or injection technique. It also maps to MITRE ATT&CK techniques related to privilege escalation and lateral movement within the application context, specifically T1078 Valid Accounts if used by malicious insiders or attackers who have obtained valid credentials with limited scope. The ability to manipulate shared resources without proper authorization facilitates persistence and potential further exploitation of downstream systems that may ingest these compromised asset model files.
To mitigate this vulnerability, organizations running Snipe-IT must upgrade immediately to version 8.7.0 or later, where the access control logic has been corrected to enforce strict separation between assets.files and models.permissions. Until an upgrade is feasible, administrators should review user roles and permissions carefully, ensuring that no users are assigned the assets.files permission unless they also require broader administrative capabilities that justify such elevation. Additionally, implementing web application firewall rules or custom middleware checks can provide a temporary layer of defense by validating request contexts against expected permission sets before allowing file operations to proceed on asset model endpoints. Regular auditing of user permissions and monitoring for unusual file attachment activities on shared models are recommended practices to detect potential exploitation attempts in environments where immediate patching is not possible.