CVE-2026-86739: Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence
Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a storage backend that is out of quota), execution continues into $acceptance->accept(), which sets acceptedat and the signaturefilename/eulafilename fields, creates the 'accepted' action-log entry, and dispatches completion notifications even though the evidence files were never stored. The result is an acceptance record marked complete whose supporting evidence files do not exist, yielding a materially incomplete compliance artifact for EULA acknowledgement or equipment-receipt workflows. The condition is triggered when an authenticated user completes an acceptance while the storage backend is silently failing writes; an attacker cannot directly force the storage backend into that state. Fixed in Snipe-IT 8.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Snipe-IT 8.6.3 and earlier are affected when users complete acceptances while the configured storage backend silently fails writes. This can occur with restrictive permissions on local storage, expired S3 credentials, or a storage backend that is out of quota.
What does an attacker need to exploit it?
An authenticated user must complete an acceptance during a silent storage-write failure. The attacker cannot directly force the storage backend into the failed state.
Are acceptance records still marked complete when evidence storage fails?
Yes. The application can set the acceptance timestamp and evidence filename fields, create an accepted action-log entry, and send completion notifications even though the signature PNG and acceptance PDF were not stored.
How can administrators identify potentially affected acceptance records?
Review completed acceptance records for missing signature PNG or generated acceptance PDF files in the configured storage backend. Records may appear accepted and have associated action-log entries and notifications despite the evidence files being absent.
What is the available fix?
Upgrade to Snipe-IT 8.7.0, which fixes the issue.