CVE-2026-86739: Snipe-IT Information Disclosure Vulnerability

CVE-2026-86739 Overview

CVE-2026-86739 is a low-severity unchecked return value vulnerability in Snipe-IT, an open-source IT asset management application. Versions 8.6.3 and earlier fail to check the return value of Storage::put() when writing signature PNG files and generated acceptance PDFs in Account\AcceptanceController::store(). When the underlying storage backend silently fails a write, the acceptance workflow still proceeds to mark the record complete and dispatch notifications. The result is a compliance artifact for End User License Agreement (EULA) acknowledgement or equipment-receipt workflows that references evidence files which do not exist. The issue is fixed in Snipe-IT 8.7.0.

Critical Impact
Acceptance records are finalized and notifications are dispatched even when the supporting signature and PDF evidence files were never persisted to storage, producing materially incomplete compliance records.

Affected Products

Snipe-IT versions 8.6.3 and earlier
Snipe-IT deployments using storage drivers that return false on write failure (local disk with restrictive permissions, S3 with expired credentials, or a backend out of quota)
Fixed in Snipe-IT 8.7.0

Discovery Timeline

2026-09-09 - CVE-2026-86739 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86739

Vulnerability Analysis

The flaw resides in Account\AcceptanceController::store(), the controller responsible for finalizing user acceptance of an asset or EULA. The controller calls Storage::put() twice: once to persist the signature PNG and once to store the generated acceptance PDF. Laravel's Storage::put() returns a boolean indicating success or failure rather than throwing an exception on many failure conditions.

Snipe-IT does not inspect the boolean return value. Execution continues into $acceptance->accept(), which sets accepted_at, populates signature_filename and eula_filename, writes an accepted action-log entry, and dispatches completion notifications. The database and audit log therefore reflect a completed acceptance while the referenced files never reached the filesystem. The weakness is classified as unchecked return value [CWE-252].

Root Cause

The root cause is a missing check on the return value of a fallible I/O operation. Filesystem drivers such as the local disk under restrictive permissions, an Amazon S3 bucket accessed with expired credentials, or any backend exceeding its quota return false instead of raising an exception. Without a guard, the controller treats failed writes as successful and advances the workflow state.

Attack Vector

This is not a directly attacker-triggered condition. Exploitation requires an authenticated user to complete an acceptance while the storage backend is silently failing writes. An external attacker cannot force the storage backend into that failure state. The realistic risk is compliance and audit integrity rather than confidentiality or integrity of the application itself. Organizations relying on Snipe-IT acceptance records as legal or regulatory evidence face incomplete artifacts that cannot be reconstructed after the fact.

See the GitHub Security Advisory GHSA-h543-58f9-v6mj and the VulnCheck Snipe-IT Advisory for additional technical context.

Detection Methods for CVE-2026-86739

Indicators of Compromise

Acceptance records in the Snipe-IT database with populated signature_filename or eula_filename values that do not resolve to a file on the configured storage backend.
accepted action-log entries with a corresponding accepted_at timestamp but no matching PNG or PDF artifact in the signatures or acceptance PDF storage paths.
Storage backend logs showing write errors (permission denied, expired credentials, quota exceeded) that coincide with acceptance completion events.

Detection Strategies

Run a reconciliation query joining the acceptances table with a filesystem or object-store inventory to identify records whose referenced filenames are missing.
Correlate application logs from the acceptance workflow with storage backend error logs to identify silent write failures during the affected window.
Monitor S3 access logs or local filesystem audit logs for PutObject or write failures originating from the Snipe-IT service account.

Monitoring Recommendations

Alert on any HTTP 4xx or 5xx responses returned by the storage backend to the Snipe-IT application host.
Track disk quota utilization and S3 credential expiration on hosts and buckets used by Snipe-IT storage.
Schedule periodic integrity audits comparing acceptance database rows to actual stored evidence artifacts.

How to Mitigate CVE-2026-86739

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which adds return-value checks to the acceptance controller.
Audit existing acceptance records to identify any that reference missing signature or PDF files and re-run those acceptance workflows where possible.
Verify storage backend health, including filesystem permissions, S3 credential validity, and available quota, before completing further acceptance workflows.

Patch Information

The vulnerability is fixed in Snipe-IT 8.7.0. The upstream fix adds validation of the Storage::put() boolean return value in Account\AcceptanceController::store() and aborts finalization when either write fails. Refer to the GitHub Security Advisory GHSA-h543-58f9-v6mj for release details.

Workarounds

Configure the storage backend to fail loudly by using drivers or wrappers that raise exceptions on write failure rather than returning false.
Enforce strict monitoring on the storage backend so that silent failure conditions (expired credentials, quota exhaustion, permission changes) are detected and remediated before acceptance workflows are executed.
Restrict acceptance workflow usage until the upgrade to 8.7.0 is completed if the deployment relies on acceptance records for regulatory compliance.

bash

# Verify Snipe-IT version and upgrade to the fixed release
php artisan --version
cd /var/www/snipe-it
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear