Improper Ownership Management Vulnerability in Snipe-IT by Grokability
CVE-2026-86769

5.3MEDIUM

Key Information:

Vendor

Grokability

Status
Snipe-it
Vendor
CVE Published:
9 September 2026

What is CVE-2026-86769?

Snipe-IT versions prior to 8.7.0 are susceptible to an improper ownership management issue that arises within the consumables checkout API endpoint. In this vulnerability, the system inaccurately logs the checkout target user's ID in the 'created_by' column instead of the ID of the authenticated user initiating the checkout. As a result, authenticated users with the consumables.checkout permission can execute checkouts that distort the audit trail within the consumables_users pivot table, making it difficult to identify the true operator responsible for the action.

Affected Version(s)

snipe-it 8.6.3 < 8.7.0

snipe-it 8.7.0

References

https://github.com/grokability/snipe-it/security/advisori...
vendor-advisory
https://www.vulncheck.com/advisories/snipe-it-before-8.7....
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

5h1kh4r
.