CVE-2026-86769: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86769 Overview

CVE-2026-86769 is an improper ownership management vulnerability [CWE-282] in Snipe-IT versions before 8.7.0. The flaw exists in the consumables checkout API endpoint. The endpoint records the checkout target user's identifier in the created_by column instead of the authenticated caller's identifier. Authenticated attackers holding the consumables.checkout permission can perform checkouts that misattribute audit trail entries in the consumables_users pivot table. The result is an obscured record of which operator actually performed the action, undermining accountability in asset management workflows.

Critical Impact
Authenticated operators can conceal their identity in Snipe-IT audit logs when checking out consumables, weakening non-repudiation and forensic investigations.

Affected Products

Snipe-IT versions prior to 8.7.0
Snipe-IT consumables checkout API endpoint
Snipe-IT consumables_users pivot table audit records

Discovery Timeline

2026-09-09 - CVE-2026-86769 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86769

Vulnerability Analysis

Snipe-IT is an open-source IT asset management platform used to track hardware, licenses, and consumables. The consumables checkout API allows an authenticated operator to assign a consumable item to another user. During this operation, Snipe-IT writes an audit record into the consumables_users pivot table to preserve who took the action and who received the item.

In versions before 8.7.0, the checkout handler populates the created_by column with the identifier of the checkout target rather than the authenticated caller. The recipient of the consumable appears as the operator who initiated the transaction. This inversion of the ownership relationship corresponds to Improper Ownership Management [CWE-282].

The impact is limited to integrity of the audit trail. No confidentiality loss, no availability impact, and no privilege escalation results from the flaw. However, in regulated environments where accountability logs support compliance, insider threat investigations, or asset loss disputes, the misattribution removes a control that stakeholders rely on.

Root Cause

The root cause is an incorrect variable assignment inside the consumables checkout controller. The code passes the target user identifier into the created_by field of the pivot record instead of the authenticated session user identifier. See the GitHub Security Advisory GHSA-x9p8-vvc5-q754 for the specific code change.

Attack Vector

An attacker requires valid authentication and the consumables.checkout permission. The attacker issues a legitimate checkout request against the consumables API to assign an item to any target user. Snipe-IT then writes a pivot row that names the recipient as both the operator and the beneficiary. Reviewers auditing the log later see no trace of the actual caller. Refer to the VulnCheck Advisory on Snipe-IT for exploitation context.

No verified proof-of-concept code is published. The vulnerability manifests through normal API usage rather than a crafted payload.

Detection Methods for CVE-2026-86769

Indicators of Compromise

Rows in the consumables_users table where created_by equals assigned_to for the same record, especially outside self-service workflows.
Audit entries showing standard end users as operators of checkouts they would not normally initiate.
Discrepancies between web server access logs identifying the authenticated session and the operator field recorded in the database.

Detection Strategies

Compare application-layer HTTP request logs against consumables_users rows to reconcile the acting session user with the recorded created_by value.
Query for consumable checkouts where the target user lacks the consumables.checkout permission yet appears as the creator of the record.
Baseline expected checkout operators per department and alert on statistical outliers in the created_by distribution.

Monitoring Recommendations

Enable and centralize Snipe-IT web server access logs alongside database audit logs for correlation.
Monitor API calls to the consumables checkout endpoint and record the authenticated user identifier at the reverse proxy layer.
Review holders of the consumables.checkout permission on a recurring schedule and restrict the role to intended operators only.

How to Mitigate CVE-2026-86769

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which corrects the assignment in the checkout handler.
Audit existing consumables_users records created on vulnerable versions and flag entries that cannot be reconciled with independent access logs.
Reduce the population of accounts holding the consumables.checkout permission to the minimum required.

Patch Information

The fix is included in Snipe-IT 8.7.0. Administrators should apply the release published through the project's official distribution channels. Refer to the GitHub Security Advisory GHSA-x9p8-vvc5-q754 for the patch commit and release notes.

Workarounds

Restrict the consumables.checkout permission to a small set of trusted operators until the upgrade is applied.
Supplement Snipe-IT audit records with reverse-proxy or web application firewall logs that capture the authenticated session identity for each checkout request.
Disable direct API access to the consumables checkout endpoint for accounts that do not require it, using network or application-layer access controls.

bash

# Configuration example
# Verify installed Snipe-IT version and plan upgrade to >= 8.7.0
php artisan --version
grep "'app_version'" config/version.php