CVE-2026-86736

Name of the Vulnerable Software and Affected Versions snipe-it versions prior to 8.7.0

Description An incorrect calculation issue in checkout request handling allows authenticated users to corrupt the assets.requests counter. This occurs when users submit duplicate checkout requests or repeatedly call cancel endpoints without having active requests. Such actions can inflate the counter or drive it into negative values, leading to a misrepresentation of pending demand within the admin queue.

Recommendations Update to version 8.7.0 or later.