Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the updateLicense, updateConsumable, updateAccessory, updateModel, and storeModel endpoints when object-level authorization is not enforced for...

CVE-2026-86773: Incorrect Authorization

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and updateModel endpoints and in the storeModel endpoint for Predefined Kits. The existing check authorizes only the parent Predefined Kit update on PredefinedKit an...