CVE-2026-86766

Snipe-IT versions up to and including 8.6.3 contain a time-of-check-to-time-of-use race condition (CWE-362) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The remaining quantity is validated before the database transaction starts, and the transaction then creates checkout records without locking the consumable row or re-checking availability, so concurrent requests can all pass the check. An authenticated user with permission to check out consumables can exploit this by submitting simultaneous checkout requests against the same consumable, over-allocating stock and driving the remaining count negative (for example, 1 remaining unit becomes -1 after two concurrent 1-unit checkouts). The impact is limited to data integrity of inventory records; there is no code execution or data exposure, and exploitation requires valid API credentials with checkout rights on an affected deployment. No exploitation in the wild, KEV listing, or public proof-of-concept is known; the flaw is fixed in 8.7.0, which re-fetches the consumable row under lockForUpdate inside the transaction and re-validates availability.

What to do: Upgrade Snipe-IT to version 8.7.0 or later, which re-checks availability under a row lock inside the transaction. Until upgraded, limit consumable checkout permissions to trusted users and consider rate-limiting or serializing requests to the checkout API endpoint, and audit consumable records for negative remaining-quantity values as evidence of over-allocation.