Executive brief
Snipe-IT is an open-source asset-management system used to track equipment and employee acknowledgements. When acceptance records (such as equipment-receipt or EULA-acknowledgement confirmations) are submitted, the system can incorrectly mark them as complete even if the supporting evidence files (signatures and PDFs) failed to save to storage. This creates fraudulent compliance records that appear accepted but have no actual evidence, undermining audit trails and regulatory compliance documentation.
Technical details
The vulnerability is an unchecked return value in Account\AcceptanceController::store() where Storage::put() calls for signature PNG and acceptance PDF files do not verify success before proceeding. On non-throwing filesystem drivers (local disk with restricted permissions, S3 with expired credentials, or quota-exhausted backends), write failures silently return false but execution continues into $acceptance->accept(), which populates accepted_at, signature_filename/eula_filename fields, creates action-log entries, and dispatches notifications despite the evidence files never being stored. Attack precondition: an authenticated user must complete an acceptance workflow while the storage backend is in a silent-failure state; an attacker cannot directly force that condition. The fix (released in 8.7.0) checks both Storage::put() return values and halts execution with an error message if either write fails, preventing the acceptance record from being finalized with missing evidence.
Affected products
- Grokability Snipe-IT 8.6.3 and earlier
Timeline
- 2026-08-24: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 8.7.0