CVE-2026-86773 describes an incorrect authorization vulnerability in Snipe-IT through version 8.6.3. The affected endpoints (updateLicense, updateConsumable, updateAccessory, updateModel, and storeModel for Predefined Kits) perform authorization checks only on the parent Predefined Kit, not on the child objects being attached. This allows users with kits.edit permission but without read permission on the child objects to attach those objects to a Predefined Kit and receive the attached object's name in the kit relation index, resulting in unauthorized information disclosure. The updateModel endpoint was vulnerable in code but not exploitable due to a routing error causing HTTP 500 responses. This vulnerability complements CVE-2026-55478, which addressed related methods in version 8.6.2. The vulnerability is resolved in Snipe-IT 8.7.0.

An authenticated user with limited permissions (kits.edit) can attach child objects (License, Consumable, Accessory, Asset Model) to Predefined Kits even if they lack read access to those objects. This leads to unauthorized disclosure of the attached object's name via the kit relation index. There is no indication of privilege escalation beyond this information disclosure or remote code execution. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited confidentiality and integrity impact.

The vulnerability is fixed in Snipe-IT version 8.7.0. Users should upgrade to version 8.7.0 or later to remediate this issue. Patch status is not explicitly stated beyond this fix version, so verify with the vendor advisory for the latest remediation guidance. No other mitigations are indicated.