CVE-2026-86734

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.1

Description Authenticated users can cause a denial of service by submitting unbounded input through the note field in the 'POST /account/accept/{acceptance}' endpoint. This occurs because the application fails to validate the length of the input before it reaches the synchronous CommonMark rendering process, which is a system for converting markdown text into HTML. Large values in the note field can exhaust PHP worker CPU resources during the markdown parsing pipeline.

Recommendations Update to version 8.7.1 or later. As a temporary mitigation, restrict the use of the note field in the 'POST /account/accept/{acceptance}' endpoint.