What is CVE-2026-86774?

CVE-2026-86774 is a medium-severity vulnerability in Grokability Snipe-It, classified under Improper Access Control. CVSS score: 6.3/10. Published 2026-09-09.

How severe is CVE-2026-86774?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Grokability Snipe-It

CVE-2026-86774

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files permission can mutate shared model file attachments across company boundaries and bypass the dedicated models.files permission intended to restrict file management on the shared Asset Model catalog.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Grokability Snipe-it

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-86774?: CVE-2026-86774 is a medium-severity vulnerability in Grokability Snipe-It, classified under Improper Access Control. CVSS score: 6.3/10. Published 2026-09-09.
How severe is CVE-2026-86774?: Medium severity. CVSS v3 base score is 6.3 out of 10.