CVE-2026-86759: Snipe-IT Authentication Bypass Vulnerability

CVE-2026-86759 Overview

CVE-2026-86759 is a missing authorization vulnerability in Snipe-IT, an open-source IT asset management platform. Versions before 8.7.0 fail to authorize the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets and inject fraudulent audit trail entries. The flaw maps to CWE-862: Missing Authorization and impacts inventory integrity across companies within a single Snipe-IT instance.

Critical Impact
Low-privileged authenticated users can reassign assets across company boundaries and forge asset history records, undermining accountability and audit trail integrity.

Affected Products

Snipe-IT versions prior to 8.7.0
Self-hosted Snipe-IT deployments exposing the /hardware/history endpoint
Multi-company Snipe-IT tenants where asset segregation is enforced

Discovery Timeline

2026-09-09 - CVE-2026-86759 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86759

Vulnerability Analysis

Snipe-IT exposes an asset history CSV importer at POST /hardware/history. The endpoint accepts a CSV file containing asset assignment records that update the hardware history log. In versions before 8.7.0, the controller does not verify whether the authenticated caller has authorization to modify the referenced assets or their history entries.

The authorization gap allows any account with a valid session, including low-privilege users, to submit history records for assets belonging to other users or other companies within the same instance. The importer writes the supplied records directly to the audit log and reassigns asset ownership based on CSV content.

Because Snipe-IT is commonly used as the system of record for IT inventory and chain-of-custody documentation, forged audit entries can undermine compliance, investigations, and asset accountability. The vulnerability affects data integrity without requiring code execution or privilege escalation at the operating system level.

Root Cause

The root cause is a missing authorization check on the /hardware/history route handler. The endpoint enforces authentication but omits the policy gate that verifies per-asset and per-company access rights. This is a classic CWE-862 pattern where authentication is conflated with authorization.

Attack Vector

An attacker requires only valid credentials to a Snipe-IT instance. The attacker crafts a CSV file containing asset IDs, target user assignments, and arbitrary timestamp and note fields. Submitting the CSV to POST /hardware/history reassigns the referenced assets and appends attacker-controlled entries to the asset history log. No user interaction from an administrator is required.

Refer to the GitHub Security Advisory GHSA-2232-926w-qvr9 and the VulnCheck Advisory on Snipe-IT for the vendor's technical write-up.

Detection Methods for CVE-2026-86759

Indicators of Compromise

Unexpected POST requests to /hardware/history originating from non-administrator accounts in web server or application logs.
Asset history entries containing timestamps that predate or contradict known assignment events.
Bulk asset reassignments performed by user accounts that do not typically administer inventory.
CSV uploads from user sessions that have never previously interacted with the importer feature.

Detection Strategies

Review Snipe-IT application logs for hardware/history requests correlated with the user role of the requester.
Baseline normal importer usage and alert on invocations by accounts outside the asset administration group.
Compare asset ownership snapshots over time and flag reassignments that cross company boundaries.

Monitoring Recommendations

Forward Snipe-IT web server access logs and application audit logs to a centralized SIEM for correlation.
Enable database-level auditing on the asset_logs and assets tables to detect out-of-band modifications.
Alert on any HTTP 200 response to POST /hardware/history from a session lacking the administrator role.

How to Mitigate CVE-2026-86759

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which introduces the missing authorization check on the asset history importer.
Audit asset history entries created before the upgrade for suspicious reassignments or forged records.
Rotate API tokens and force password resets if unauthorized history modifications are identified.
Restrict network exposure of the Snipe-IT web interface to trusted administrative networks where feasible.

Patch Information

The fix is available in Snipe-IT 8.7.0. See the GitHub Security Advisory GHSA-2232-926w-qvr9 for release details and remediation guidance.

Workarounds

If immediate patching is not possible, block or restrict access to the /hardware/history route at a reverse proxy or web application firewall so only administrator source IPs can reach it.
Temporarily disable the asset history CSV importer feature in environments that do not require it.
Reduce the number of authenticated user accounts to the minimum required, and review role assignments to enforce least privilege.

bash

# Example nginx snippet restricting the vulnerable endpoint to an admin subnet
location = /hardware/history {
    allow 10.10.20.0/24;   # admin management network
    deny all;
    proxy_pass http://snipeit_backend;
}