CVE-2026-86759

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description An authorization failure exists in the 'POST /hardware/history' endpoint, which allows any authenticated user to reassign arbitrary assets and modify audit logs. By submitting a CSV file, an attacker can reassign assets across different companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

Recommendations Update to version 8.7.0 or later. As a temporary mitigation, restrict access to the 'POST /hardware/history' endpoint.