CVE-2026-86765: Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigneduser, assignedasset, or assignedlocation parameters to PATCH /api/v1/hardware/{id}.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user needs permission to edit assets, while being denied checkout permission. Such a user can still submit assignment-related fields to the asset update API endpoint.
Which systems are affected?
Snipe-IT versions before 8.7.0 are affected. The issue applies when users can access PATCH /api/v1/hardware/{id} and have asset edit permission.
What can an attacker change through the bypass?
They can reassign assets using assigned_user, assigned_asset, or assigned_location parameters. This can bypass normal check-in procedures and alter asset custody records.