CVE-2026-86768

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86768

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86768.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86768

Aliases

GHSA-qffp-xpqv-gqr4

Published

2026-09-09T13:32:25Z

Modified

2026-09-11T03:48:43Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Snipe-IT before 8.7.0 Improper Input Validation via API Checkout

Details

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86768.json"
}

References

Affected packages

Git / github.com/grokability/snipe-it

Affected ranges

Type

GIT

Repo

https://github.com/grokability/snipe-it

Events

Introduced

cfd1ff8413e478a8daab700c15e96c96f93220e2

Fixed

1d05a7ce11e6bf9448c067ac3ffbe5e63882888e

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "8.6.3"
        },
        {
            "fixed": "8.7.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86768.json"