CVE-2026-86734

Snipe-IT, an open-source IT asset management application, fails in versions before 8.7.1 to validate the length of the note field submitted to the POST /account/accept/{acceptance} endpoint. An authenticated user can submit an arbitrarily large note value, which is passed synchronously into CommonMark markdown rendering, consuming disproportionate PHP worker CPU. By submitting oversized notes (optionally repeated), an attacker can exhaust PHP worker capacity and cause a denial of service for other users; the impact is availability-only, with no confidentiality or integrity effect described in the scoring. Any organization running an affected Snipe-IT release is affected, especially where many or semi-trusted internal users can accept assigned assets. There is no known public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS estimates only about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade to Snipe-IT 8.7.1 or later, which adds length validation on the acceptance note field. As an interim mitigation, cap POST body size and rate-limit or restrict access to the /account/accept/{acceptance} endpoint at the reverse proxy, and monitor PHP worker CPU saturation for signs of resource exhaustion. Because exploitation requires an authenticated account, review which users can reach the asset acceptance workflow to gauge exposure.