Race Condition Vulnerability in Snipe-IT by Grokability

CVE-2026-86744

What is CVE-2026-86744?

The Snipe-IT application, specifically versions 8.6.3 and earlier, contains a race condition vulnerability that impacts the asset checkout functionality. When two concurrent checkout requests for the same asset are made, both requests can be processed as available without proper locking mechanisms in place. This flaw leads to the creation of duplicate entries in checkout history, inaccurately inflating the checkout counter and resulting in erroneous reconciliation reports. Although the visible assignment remains unchanged, the audit trail gets corrupted, compromising the integrity of asset management. Users with authenticated access, including those with superuser privileges, can exploit this vulnerability under specific timing conditions. The issue has been resolved in version 8.7.0.

References