https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T12:56:22.948202+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-86753 CVE-2026-86753 — snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint 2026-10-08T12:56:22.950075+00:00

Affected: grokability snipe-it

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.