CVE-2026-86736: Snipe-IT Privilege Escalation Vulnerability

CVE-2026-86736 Overview

CVE-2026-86736 is an incorrect calculation vulnerability [CWE-682] in Snipe-IT versions before 8.7.0. The flaw resides in the checkout request handling logic, where the assets.requests_counter value can be corrupted by authenticated users. Attackers can inflate the counter by submitting duplicate checkout requests or drive it negative by repeatedly calling cancel endpoints without an active request. The result is a misrepresentation of pending asset demand in the administrator queue, which undermines the integrity of asset management workflows.

Critical Impact
Authenticated users can manipulate the pending request counter shown to administrators, distorting operational visibility into asset checkout demand without triggering authentication or authorization controls.

Affected Products

Snipe-IT by snipeitapp
All versions prior to 8.7.0
Deployments exposing checkout request and cancellation endpoints to authenticated users

Discovery Timeline

2026-09-08 - CVE-2026-86736 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86736

Vulnerability Analysis

The vulnerability stems from missing state validation in Snipe-IT's checkout request workflow. The assets.requests_counter column tracks the number of pending asset checkout requests per asset. The application updates this counter without verifying whether a corresponding active request exists at the time of increment or decrement.

An authenticated user can submit the same checkout request multiple times, and each submission increments the counter without deduplication. Conversely, calling the cancel endpoint when no active request exists still decrements the counter, allowing it to drop below zero. This produces an integrity failure in the administrative view of pending demand, which administrators rely on to make provisioning decisions.

Root Cause

The root cause is an incorrect calculation flaw categorized under [CWE-682]. The checkout request handler performs arithmetic operations on the counter without transactional validation of the underlying request state. There is no atomic check-and-update ensuring that a decrement corresponds to a real cancellation, and no uniqueness constraint preventing duplicate active requests from inflating the total.

Attack Vector

Exploitation requires network access and low-privileged authenticated access to the Snipe-IT web application. No user interaction is required beyond the attacker's own submissions. The attacker interacts with the standard checkout request and cancel HTTP endpoints, replaying requests or issuing cancels against assets without holding an active request. Impact is limited to data integrity of the request counter; confidentiality and availability are not affected.

See the VulnCheck Advisory on Snipe-IT for additional technical context on the affected endpoints.

Detection Methods for CVE-2026-86736

Indicators of Compromise

Negative values in the assets.requests_counter column of the Snipe-IT database
Counter values that exceed the number of distinct pending requests visible in the checkout_requests table
Repeated POST submissions to checkout request endpoints from a single authenticated user within a short window
High volume of cancel endpoint calls from a user with no matching active requests in application logs

Detection Strategies

Reconcile assets.requests_counter against the actual count of active rows in the checkout requests table on a scheduled basis
Alert on any user account issuing more than a defined threshold of checkout or cancel requests per minute
Correlate authenticated session activity with request state transitions to identify replayed or orphaned cancellations

Monitoring Recommendations

Enable verbose application logging for the checkout request controller and cancellation handler in Snipe-IT
Forward Snipe-IT web server access logs to a centralized log platform for behavioral analytics on request patterns
Monitor administrative dashboards for anomalous counter values that do not align with observed user activity

How to Mitigate CVE-2026-86736

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later as published in the vendor advisory
Audit the assets.requests_counter column across all assets and reset values that do not match the count of active requests
Review authenticated user activity logs for evidence of duplicate submissions or orphaned cancellations prior to patching

Patch Information

The maintainers released a fix in Snipe-IT 8.7.0. Details are available in the GitHub Security Advisory GHSA-hc9q-5x9h-9gxc. The patch enforces state validation so that counter updates only occur when a corresponding request exists and duplicate submissions are rejected.

Workarounds

Restrict access to the Snipe-IT application to trusted user populations until the upgrade to 8.7.0 is complete
Implement a scheduled database job to recalculate assets.requests_counter from the authoritative checkout requests table
Apply rate limiting at the reverse proxy or web application firewall for checkout request and cancel endpoints

bash

# Example: recalculate counters from the authoritative table (adapt to your schema)
UPDATE assets a
SET requests_counter = (
  SELECT COUNT(*) FROM checkout_requests cr
  WHERE cr.asset_id = a.id AND cr.canceled_at IS NULL
);