Description

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T14:17:24.447Z",
  "pubdate": "2026-09-09T14:17:24.447Z",
  "executiveSummary": "This vulnerability is an Improper Authorization flaw identified in the asset request workflow of Snipe-IT versions prior to 8.7.0.\nThe vulnerability resides within the POST /account/request/asset_model/{modelId} endpoint, where the application fails to perform necessary validation checks against the 'requestable' configuration flag defined for specific asset models.\nImpact includes the unauthorized generation of asset checkout requests, allowing standard authenticated users to bypass administrative business logic and request assets designated as non-requestable by system administrators.\nThis flaw grants authenticated attackers the ability to circumvent access control policies, potentially leading to unauthorized inventory allocation and administrative overhead.\nThe vulnerability requires a valid user session, as the endpoint is protected by authentication mechanisms; however, it does not require administrative privileges, as the validation bypass occurs server-side once the request is initiated by any authenticated user.\nRisk implications include potential disruption of asset management workflows and the circumvention of established internal provisioning policies.",
  "technicalDetails": "The root cause of this vulnerability is an authorization logic failure in the request processing pipeline for asset models. In Snipe-IT, the 'requestable' flag is a security control designed to restrict which assets can be requested by standard users through the interface. The application logic is intended to check this flag against the target modelId before authorizing the creation of a database entry for the request.\nIn affected versions (pre-8.7.0), the POST /account/request/asset_model/{modelId} endpoint fails to enforce this validation check. Instead of validating the state of the asset model, the server-side handler proceeds to process the request based solely on the presence of a valid session token.\nThe attack flow begins when an authenticated user identifies the modelId of an asset model configured as 'non-requestable'. The attacker constructs a crafted HTTP POST request targeting the /account/request/asset_model/{modelId} endpoint. Because the backend application logic omits the verification of the 'requestable' attribute, the system accepts the input and proceeds to generate a request record in the backend database.\nThis represents an Insecure Direct Object Reference (IDOR) or Authorization Bypass condition where the security boundary depends entirely on the UI client's ability to hide options, rather than server-side enforcement. The absence of server-side validation allows the client to supply arbitrary model IDs that the user would not normally be permitted to interact with.\nPost-exploitation impact manifests as the unauthorized creation of checkout requests for restricted hardware or software assets. This forces administrative intervention to clear or deny these illegitimate requests, thereby disrupting supply chain management and inventory control. As the system interprets these requests as legitimate user-initiated actions, the application state is altered in favor of the attacker's intent, effectively overriding the administrative policy defined in the asset management configuration."
}