CVE-2026-86766

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description A race condition known as TOCTOU (Time-of-Check to Time-of-Use) exists in the consumable checkout API endpoint 'POST /api/v1/consumables/{consumable id}/checkout'. The system validates the requested quantity against remaining units before the database transaction starts, but fails to lock the consumable row or re-verify availability during the transaction. This allows an authenticated user with checkout permissions to send concurrent requests that bypass availability checks, resulting in over-allocation of stock and negative inventory levels.

Recommendations Update to version 8.7.0.