CVE-2026-86744

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description A race condition exists in the asset checkout paths. The functions ApiAssetsController::checkout() and AssetsAssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and subsequently invoke Asset::checkOut() without implementing a row lock or re-verifying availability. Consequently, two concurrent checkout requests for the same available asset can both be processed as successful. This results in duplicate checkout-history rows, a doubled checkout counter, and two CheckoutableCheckedOut events for a single-assignment asset, which corrupts the audit trail and utilization/reconciliation reporting. The final assigned to value remains singular, leaving the visible assignment intact. Exploitation requires an authenticated session with the assets.checkout permission or superuser privileges, combined with precise concurrent timing.

Recommendations Update to version 8.7.0.