CVE-2026-86765
Medium
Description
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned_location parameters to PATCH /api/v1/hardware/{id}.
SeverityMedium
CVSS6.5
Exploit probability35. percentile0.4%
ProductSnipeitapp Snipe-it
PublishedSep 9, 2026
First seenSep 9, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- snipeitapp snipe-it8.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| snipeitapp snipe-it | v < 8.7.0 | 8.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.