Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-86765: Snipe‑IT lets unauthorized users reassign assets

CVE-2026-86765 · published 1 month ago

Summary

In Snipe‑IT versions before 8.7.0, a user who can edit items but is not allowed to check them out can still change the assigned user, asset, or location through the update API. This lets the user bypass the normal check‑in/check‑out process and tamper with custody records. Upgrade to version 8.7.0 or later, or apply the vendor's patch, to enforce proper checkout permissions.

What to do

Update grokability snipe-it to version 8.7.0 or later.
Update snipeitapp snipe-it to version 8.7.0 or later.

Affected software

Vendor	Product	Affected versions
grokability	snipe-it	< 8.7.0
snipeitapp	snipe-it	< 8.7.0 `cpe:2.3:a:snipeitapp:snipe-it::::::::`

Original advisory text

Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned_location parameters to PATCH /api/v1/hardware/{id}.

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-6g2g-83pc-6365 Vendor Advisory
https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d... Patch
https://www.vulncheck.com/advisories/snipe-it-8.6.3-authorization-bypass-via-ass... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86765... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-86765 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published9 Sep 2026

Updated4 Nov 2026

First seen9 Sep 2026

Sources

CVE-2026-86765 · NVD

CVE-2026-86765 · MITRE

CVE-2026-86765 · OSV

GHSA-6g2g-83pc-6365 · GHSA

Track software like this

Free during beta