What is GHSA-v2q3-m84w-cp4m?

GHSA-v2q3-m84w-cp4m is a security advisory published by GitHub Security Advisories with Medium severity. snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST...

Which CVE IDs does GHSA-v2q3-m84w-cp4m cover?

GHSA-v2q3-m84w-cp4m covers the following CVE IDs: CVE-2026-86753. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v2q3-m84w-cp4m?

GHSA-v2q3-m84w-cp4m has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-v2q3-m84w-cp4mMediumCVSS 4.3

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-86753 →

📋 Description

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

🔗 References (4)

https://github.com/grokability/snipe-it/security/advisories/GHSA-xmcp-mrw5-cg3g
https://nvd.nist.gov/vuln/detail/CVE-2026-86753
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-business-logic-bypass-via-asset-model-endpoint
https://github.com/advisories/GHSA-v2q3-m84w-cp4m