CVE-2026-86739

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description In the AccountAcceptanceController::store() function, the software fails to verify the return value of Storage::put() when saving signature PNGs and generated acceptance PDFs. On filesystem drivers that return a false value instead of throwing an exception during write failures—such as local disks with restrictive permissions, S3 with expired credentials, or storage backends exceeding quotas—the process continues to the accept() function. This results in the accepted at, signature filename, and eula filename fields being updated, an accepted action-log entry being created, and completion notifications being sent, despite the evidence files not being stored. This creates incomplete compliance artifacts for equipment-receipt or EULA acknowledgement workflows. The issue occurs when an authenticated user completes an acceptance while the storage backend is failing writes.

Recommendations Update to version 8.7.0.