Snipe-IT Vulnerability in Acceptance Finalization and Evidence Storage
CVE-2026-86739

2.3LOW

Key Information:

Vendor

Grokability

Status
Snipe-it
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86739?

Earlier versions of Snipe-IT, specifically 8.6.3 and prior, exhibit a flaw in the processing of acceptance records where the system fails to verify the success of storage operations when writing key evidence files. When storage backends experience write failures—due to issues like restrictive filesystem permissions or expired credentials—users can still have their acceptance records marked as completed without the requisite evidence files being stored. This oversight can result in incomplete records for EULA acknowledgments and equipment-receipt workflows. The issue was rectified in version 8.7.0, emphasizing the importance of validating storage outcomes in compliance management.

Affected Version(s)

snipe-it 0 < 8.7.0

snipe-it 8.7.0

References

https://github.com/grokability/snipe-it/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7....
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

christopherfi-dev
snipe
.