# CVE-2026-86736: snipe-it checkout request counter integrity failure

Source: https://junglewise.ai/threats/cve-2026-86736-snipe-it-checkout-request-counter-integrity-failure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86736 · Severity: medium · CVSS 4.3 · Published 2026-09-08

snipe-it is an asset tracking and inventory management application used by organizations to manage hardware checkouts and requests. A flaw in the checkout request handling allows authenticated users to corrupt the counter that tracks pending asset requests through duplicate submissions or repeated cancellations, causing the admin queue to show inaccurate demand and misrepresenting available inventory status.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86736 being exploited in the wild.

**How severe is CVE-2026-86736?** Medium severity, with a CVSS score of 4.3, published 8 September 2026.

**Which products and versions are affected?** Grokability snipe-it before 8.7.0.

**Is there a fix for CVE-2026-86736?** A patch was published on 2026-08-24: Fixed in version 8.7.0; commit 1f978ed068 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86736 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86736?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incorrect calculation flaw (CWE-682) in the checkout request handling logic affecting CreateCheckoutRequestAction and CancelCheckoutRequestAction components. Authenticated users can exploit two distinct attack paths: (1) calling the cancel endpoint repeatedly without an active request to drive requests_counter negative, and (2) submitting duplicate checkout requests that increment the counter multiple times while only decrementing once on cancel. The flaw stems from missing validation of active request state and stale eager-loaded data. The attack requires network access and low-privilege authentication; no user interaction is needed. Exploitation corrupts the requests_counter integrity and inflates the admin queue, misrepresenting pending demand. The patch, released in version 8.7.0, adds validation checks, fresh database queries, and transaction-level consistency between counter updates and request records.

## Affected products

- Grokability snipe-it before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory published
- 2026-08-24: patched: Fixed in version 8.7.0; commit 1f978ed068
- 2026-09-08: advisory: CVE-2026-86736 published; NVD entry created

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-hc9q-5x9h-9gxc](https://github.com/grokability/snipe-it/security/advisories/GHSA-hc9q-5x9h-9gxc)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-checkout-request-counter-integrity-failure](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-checkout-request-counter-integrity-failure)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)