CVE-2026-86773 grokability CVE debrief

Who should care

Snipe-IT administrators and users with kits.edit permission should assess exposure and apply patches to prevent unauthorized attachments. Additionally, security teams and vulnerability management teams should review the vulnerability and its potential impact on the organization. Operators and platform administrators should also be aware of the vulnerability and its potential effects on the system.

Why it matters

CVE-2026-86773 is a medium-severity vulnerability in Snipe-IT that allows an authenticated user to bypass access controls and attach unauthorized objects to a Predefined Kit, potentially disclosing sensitive information. Defenders should prioritize verifying exposure and applying patches for Snipe-IT versions prior to 8.7.0.

• Potential unauthorized data exposure through attached object names
• Bypass of intended access controls for Predefined Kits
• Required verification of Snipe-IT version and user permissions
• Potential for low-privilege users to access sensitive information

Technical summary

Snipe-IT through version 8.6.3 fails to perform object-level authorization in certain endpoints, allowing an authenticated user with kits.edit permission to attach unauthorized objects to a Predefined Kit. The issue is fixed in Snipe-IT 8.7.0, and defenders should prioritize verifying exposure and applying patches for Snipe-IT versions prior to 8.7.0. The vulnerability has a CVSS score of 5.3 and a medium severity, indicating a moderate risk to affected systems. This vulnerability is a counterpart to CVE-2026-55478, which fixed only the storeLicense, storeConsumable, and storeAccessory methods in 8.6.2.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Snipe-IT versions prior to 8.7.0.

Recommended defensive actions

• Verify Snipe-IT version and apply patches if necessary
• Restrict kits.edit permission to authorized users
• Monitor for unauthorized attachments to Predefined Kits
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The vulnerability was introduced due to inadequate authorization checks in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints, as well as the storeModel endpoint for Predefined Kits. The existing check only authorizes the parent Predefined Kit and not the child object being attached. This issue is fixed in Snipe-IT 8.7.0, and defenders should verify exposure and apply patches to prevent unauthorized S.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.