CVE-2026-86744

Snipe-IT versions 8.6.3 and earlier (including develop-branch pre-release commits prior to the fix) contain a TOCTOU race condition (CWE-362) in the asset checkout paths: Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() check Asset::availableForCheckout() outside the mutation path and then call Asset::checkOut() without a row lock or a re-check, so two concurrent requests can both see an asset as available and both commit. An authenticated attacker with the assets.checkout permission (or superuser) who times simultaneous checkout requests for the same asset gains duplicated checkout-history rows, a doubled checkout_counter, and two CheckoutableCheckedOut events for a single-assignment asset — corrupting the audit trail and skewing utilization and reconciliation reports. The asset's final assigned_to value remains singular, so the visible assignment itself stays intact, limiting impact to data integrity of records. All self-hosted Snipe-IT deployments on affected versions are exposed, though exploitation requires privileged credentials and precise timing. The vendor published a security advisory (GHSA-h992-9438-26v8) and no exploitation in the wild is known.

What to do: Upgrade Snipe-IT to 8.7.0, which adds proper serialization/availability re-checking in the checkout path. After upgrading, audit checkout-history tables and checkout_counter values for assets showing duplicate checkout events from the same timestamp window, and reconcile affected reporting. Since exploitation requires an authenticated assets.checkout (or superuser) role, review which accounts hold that permission and monitor for anomalous concurrent checkout bursts.