CVE-2026-86769

Snipe-IT versions before 8.7.0 mishandle ownership attribution in the consumables checkout API endpoint, recording the checkout target user's id in the created_by column instead of the id of the authenticated caller. Any authenticated user holding the consumables.checkout permission can trigger a checkout that produces misattributed audit trail entries in the consumables_users pivot table. The attacker gains the ability to obscure which operator actually performed a consumable checkout, degrading the integrity of the asset audit trail, with no confidentiality or availability impact (CVSS 4.0 integrity-low only). All Snipe-IT deployments running a version earlier than 8.7.0 that grant consumables.checkout to non-administrative users are affected. No exploitation has been reported in the wild: EPSS is low at 0.2% (5th percentile), the issue is not in CISA KEV, and the flaw is documented in a public vendor advisory (GHSA-x9p8-vvc5-q754).

What to do: Upgrade Snipe-IT to version 8.7.0 or later. Until patched, restrict the consumables.checkout permission to trusted operators only and review consumables_users records for created_by values that match checkout target users rather than the operators who actually performed the checkouts. Where audit attribution matters, cross-reference API/web-server access logs to reconstruct the true operator for recent consumable checkouts.