CVE-2026-86765

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/{id}' endpoint, an attacker can reassign assets, bypass check-in procedures, and modify custody records. The affected parameters are assigned user, assigned asset, and assigned location.

Recommendations Update to version 8.7.0 or later. Restrict the use of the assigned user, assigned asset, and assigned location parameters in the 'PATCH /api/v1/hardware/{id}' endpoint for users without checkout permissions.