CVE-2026-86765
Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by submitting assigned_user, assigned_asset, or assigned_location parameters to PATCH /api/v1/hardware/{id}.
| CWE | CWE-862 |
| Vendor | grokability |
| Product | snipe-it |
| Published | Sep 9, 2026 |
| Last Updated | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for grokability snipe-it
Be the first to know when new medium vulnerabilities affecting grokability snipe-it are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
grokability / snipe-it
8.6.3 < 8.7.0
References
github.com: https://github.com/grokability/snipe-it/security/advisories/GHSA-6g2g-83pc-6365 github.com: https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206 vulncheck.com: https://www.vulncheck.com/advisories/snipe-it-8.6.3-authorization-bypass-via-asset-update-endpoint
Credits
🔍 nullbenny 🔍 builtbybrayden