CVE-2026-86768 Overview
CVE-2026-86768 is an improper input validation vulnerability [CWE-20] in Snipe-IT versions before 8.7.0. The flaw exists in the application's API checkout endpoints, which fail to validate the soft-deleted state of target records. Authenticated users with checkout permissions can bind live inventory to trashed users, assets, or locations. The result is orphaned references that corrupt the asset ledger and audit trails maintained by the IT asset management platform.
Critical Impact
Authenticated attackers with low privileges can corrupt asset inventory data integrity and audit trails by checking out hardware, components, or consumables to soft-deleted targets over the network.
Affected Products
- Snipe-IT IT asset management platform
- All versions prior to 8.7.0
- Deployments exposing hardware, component, and consumable checkout API endpoints
Discovery Timeline
- 2026-09-09 - CVE-2026-86768 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86768
Vulnerability Analysis
Snipe-IT provides REST API endpoints for checking out inventory items to users, assets, or locations. The checkout endpoints accept target identifiers in POST request bodies and associate inventory records with those targets. The API skips a required state check that would confirm the referenced target has not been soft-deleted. Snipe-IT uses soft deletion to preserve historical records while removing entities from active use. When the API binds a live hardware item, component, or consumable to a trashed target, the resulting relationship becomes orphaned. This orphaned reference undermines the integrity of the asset ledger and produces misleading audit trail entries.
Root Cause
The root cause is missing input validation on the target identifier fields in hardware, component, and consumable checkout controllers. The application resolves the ID to a database record without applying the whereNull('deleted_at') scope that distinguishes active records from soft-deleted ones. Version 8.7.0 introduces the required state check to reject checkout requests targeting trashed entities.
Attack Vector
Exploitation requires an authenticated account with checkout permissions and network access to the Snipe-IT API. The attacker submits a POST request to a checkout endpoint such as the hardware checkout route, supplying a user_id, asset_id, or location_id that references a soft-deleted record. The server accepts the request and creates the assignment. Over time, repeated abuse fragments the inventory ledger, complicates compliance reporting, and can conceal the true custody of high-value assets. The vulnerability does not enable code execution, credential theft, or data exfiltration.
No public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-qffp-xpqv-gqr4 and the VulnCheck Advisory Snipe-IT API for the maintainer's technical description.
Detection Methods for CVE-2026-86768
Indicators of Compromise
- Checkout records in the assets_users, components_assets, or consumables_users tables where the assigned target has a non-null deleted_at timestamp.
- Audit log entries in action_logs that reference user, asset, or location IDs no longer present in the active views.
- Inventory reports showing hardware or consumables with no resolvable current custodian despite an active checkout status.
Detection Strategies
- Run scheduled database queries that join checkout tables against target tables filtered on deleted_at IS NOT NULL to enumerate orphaned assignments.
- Enable Snipe-IT API request logging and alert on POST requests to /api/v1/hardware/{id}/checkout, /api/v1/components/{id}/checkout, and /api/v1/consumables/{id}/checkout that originate from unexpected accounts or high volumes.
- Correlate API activity with subsequent inventory reconciliation failures to identify accounts abusing the endpoint.
Monitoring Recommendations
- Forward Snipe-IT web server access logs and application audit logs to a centralized analytics platform for correlation across accounts and endpoints.
- Baseline the volume and pattern of checkout API calls per user and alert on deviations that suggest scripted abuse.
- Review privileged account usage of checkout permissions during regular access reviews to reduce the attacker population.
How to Mitigate CVE-2026-86768
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later, which enforces soft-deleted state validation in the affected checkout endpoints.
- Audit existing checkout records for references to soft-deleted users, assets, and locations, then reassign or restore records to reflect true custody.
- Restrict checkout API permissions to the minimum set of accounts required for daily operations and rotate API tokens for accounts that no longer need them.
Patch Information
The fix is available in Snipe-IT 8.7.0. Review the GitHub Security Advisory GHSA-qffp-xpqv-gqr4 for the upstream commit references and upgrade guidance published by the Snipe-IT maintainers.
Workarounds
- Place the Snipe-IT API behind a reverse proxy or web application firewall that blocks POST requests to checkout endpoints from unapproved source addresses until the upgrade is complete.
- Reduce or revoke the assets.checkout, components.checkout, and consumables.checkout permissions on non-essential roles to shrink the pool of accounts able to trigger the flaw.
- Schedule frequent integrity checks that reject or quarantine checkout records pointing to trashed targets pending manual review.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.