CVE-2026-86765

Snipe-IT versions before 8.7.0 contain a missing-authorization flaw (CWE-862) in the asset update endpoint, PATCH /api/v1/hardware/{id}. When assignment parameters such as assigned_user, assigned_asset, or assigned_location are submitted, the application enforces edit permission but fails to verify that the user holds checkout permission. An authenticated user with edit rights but an explicit checkout denial can therefore reassign assets, bypass required check-in procedures, and alter asset custody records. This affects any organization running Snipe-IT 8.6.x or earlier where role-based permissions are used to restrict checkout rights, particularly multi-tenant or helpdesk-style deployments. There is no public proof of concept, the issue is not in CISA's KEV catalog, and no exploitation has been reported to date.

What to do: Upgrade to Snipe-IT 8.7.0 or later, which enforces checkout authorization on the asset update endpoint. In the meantime, review role configurations to identify users or groups with edit permission but no checkout permission, and audit recent asset custody changes and API activity on /api/v1/hardware for unauthorized reassignments or skipped check-ins.