CVE-2026-86769: Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout
Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the createdby column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumablesusers pivot table, obscuring which operator performed the action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the consumables.checkout permission. The issue affects Snipe-IT versions before 8.7.0.
What is the impact of exploitation?
Consumables checkout records can attribute the action to the target user rather than the authenticated operator. This can make the consumables_users audit trail unreliable for determining who performed a checkout.
Are unauthenticated or read-only users affected?
No. Exploitation requires an authenticated caller with permission to check out consumables.
How can I identify potentially affected audit records?
Review consumables checkout entries in the consumables_users pivot table, particularly where the created_by value matches the checkout target user. Such records may not identify the operator who initiated the checkout.