Denial of Service Vulnerability in Snipe-IT by Grokability

CVE-2026-86734

What is CVE-2026-86734?

Snipe-IT before version 8.7.1 is vulnerable to a denial of service attack due to insufficient validation of the 'note' field in the POST /account/accept/{acceptance} endpoint. This vulnerability allows authenticated users to submit excessively large inputs, overloading the PHP worker process and resulting in service interruptions. Attackers can exploit this flaw to consume system resources through the markdown rendering process, effectively crippling the application. It is crucial for users of affected versions to implement the necessary patches to mitigate this risk.

References