THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86774 (MEDIUM 6.3) — Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.f

[NVD] CVE-2026-86774 (MEDIUM 6.3) — Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.f

mednvdPublished 2026-09-09

CVE-2026-86774 CVSS: 6.3 MEDIUM Published: 2026-09-09T14:17:28.363

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from assets.files permission, allowing authenticated users to upload and delete file attachments on Asset Model records without the required models.files permission. Attackers with only assets.files pe

Indicators of compromise

CVE-2026-86774cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86774