CVE-2026-86768: Snipe-IT before 8.7.0 Improper Input Validation via API Checkout
Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Snipe-IT user needs checkout permissions and access to the affected API checkout endpoints. The attacker can target soft-deleted user, asset, or location records.
Which checkout operations are affected?
The affected API operations are checkout requests for hardware, components, and consumables. A crafted POST request can bind live inventory to a trashed target.
What is the impact of successful exploitation?
Successful requests can create orphaned references in the asset ledger and audit trails. The stated impact is integrity and availability degradation, rather than confidentiality exposure.
How can I determine whether my deployment is affected?
Deployments running a version before 8.7.0 are affected. Review checkout records and audit trails for live inventory associated with soft-deleted users, assets, or locations.