CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable due to inadequate validation of the requestable flag for asset models, allowing authenticated users to bypass administrative restrictions. This flaw enables unauthorized creation of checkout requests for non-requestable asset models, potentially leading to misuse of assets. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized asset management actions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly to the endpoint.
Related CVEs
Other vulnerabilities affecting the same vendor(s)