CVE-2026-86759

Snipe-IT versions before 8.7.0 contain a missing-authorization flaw (CWE-862) on the POST /hardware/history endpoint, which is reachable by any authenticated user regardless of assigned role. By sending crafted requests to this endpoint — including submitting a CSV import — a low-privileged authenticated user can reassign arbitrary assets, move assets across companies, and inject or alter entries in the audit trail. An attacker gains the ability to corrupt inventory records and forge accountability history, which can mask asset theft, loss, or misassignment; the flaw does not appear to grant confidentiality compromise or full system takeover. Any organization running an affected Snipe-IT version is exposed, with risk concentrated on instances where non-admin accounts exist and the asset history matters for compliance or audit purposes. There is currently no known public proof-of-concept, and the flaw is not listed in CISA's KEV, so no in-the-wild exploitation has been confirmed.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which adds the missing authorization check on the /hardware/history endpoint. As an interim mitigation, restrict access to the hardware history route to administrator-level roles and review audit logs for unexpected asset reassignments or CSV-imported history entries made by non-admin accounts. The flaw requires authentication, so internet exposure is less critical than role hygiene, but public-facing instances should be patched promptly.