Nullbenny

Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/{id}' endpoint, an attacker can reassign assets, bypass check-in procedures, and modify custody records. The affected parameters are `assigned user`, `assigned asset`, and `assigned location`.

A race condition known as TOCTOU (Time-of-Check to Time-of-Use) exists in the consumable checkout API endpoint 'POST /api/v1/consumables/{consumable id}/checkout'. The system validates the requested quantity against remaining units before the database transaction starts, but fails to lock the consumable row or re-verify availability during the transaction. This allows an authenticated user with checkout permissions to send concurrent requests that bypass availability checks, resulting in over-allocation of stock and negative inventory levels.