In snipe-it versions prior to 8.7.0, the POST /account/request/asset_model/{modelId} endpoint does not properly validate the 'requestable' flag on asset models. As a result, authenticated users with limited privileges can circumvent administrative controls and create checkout requests for asset models that should not be requestable. This represents an incorrect authorization vulnerability allowing privilege escalation within the asset request functionality.

Authenticated users can bypass intended administrative restrictions and create checkout requests for asset models that are marked as non-requestable. This could lead to unauthorized asset allocation or misuse of asset management workflows. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint to trusted users only and monitor for unusual asset request activity. Avoid relying solely on client-side or superficial checks of the 'requestable' flag.