CVE-2026-86759: Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Restrict access to the Snipe-IT POST /hardware/history endpoint so that only authorized/admin users can use the asset-history CSV importer until the system is upgraded to 8.7.0.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated Snipe-IT user can exploit the affected endpoint. The attacker does not need elevated privileges, but must be able to authenticate to the application.
What access and actions does exploitation require?
An attacker needs network access to the Snipe-IT instance, a valid user account, and the ability to submit a CSV file to the POST /hardware/history endpoint. No user interaction is required.
What is the impact of a successful exploit?
An attacker can reassign arbitrary assets across companies and add fraudulent entries to the audit trail. This compromises inventory integrity and accountability; the provided severity vector indicates no confidentiality impact, high integrity impact, and low availability impact.
Which versions are affected?
Snipe-IT versions before 8.7.0 are affected. Upgrading to 8.7.0 or later addresses the affected version range described here.