CVE-2026-86736: snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requestscounter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Snipe-IT user can exploit it. No user interaction is required, and the vulnerable actions can be performed over the network.
What actions cause the request counter to become inaccurate?
Repeated cancellation requests when no active request exists can drive assets.requests_counter negative. Submitting duplicate checkout requests can inflate the counter and make pending demand appear higher than it is.
What is the operational impact of a manipulated counter?
The admin queue can misrepresent the number of pending checkout requests. This affects the integrity of request-demand information rather than confidentiality or service availability.
Which versions need remediation?
Snipe-IT versions before 8.7.0 are affected. Updating to 8.7.0 or later addresses the affected version range described in the advisory.