# CVE-2026-86759: Snipe-IT missing authorization in asset-history CSV importer

Source: https://junglewise.ai/threats/cve-2026-86759-snipe-it-missing-authorization-in-asset-history-csv-importer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86759 · Severity: high · CVSS 7.1 · Published 2026-09-09

Snipe-IT is an open-source asset management system used by organizations to track and manage IT hardware inventory. A flaw in versions before 8.7.0 allows any logged-in user to reassign company assets and falsify audit logs without proper permission checks, potentially enabling unauthorized asset transfers and destruction of audit accountability across the entire system or across multiple companies in multi-tenant deployments.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86759 being exploited in the wild.

**How severe is CVE-2026-86759?** High severity, with a CVSS score of 7.1, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86759?** A patch was published on 2026-09-09: Fixed in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86759 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86759?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The POST /hardware/history endpoint (AssetsController::postImportHistory) lacks authorization checks despite being part of a legacy CSV import feature, allowing authenticated users to submit asset reassignment records without admin or asset-edit privileges. While the corresponding GET handler enforces admin authorization, the POST handler relies only on class-level auth middleware, permitting any authenticated session to submit a multipart CSV file. For each matched asset_tag, the importer reassigns assets and creates fake audit log entries attributed to the attacker, bypassing company scoping and normal checkout policies. In multi-company (FMCS) deployments this becomes a cross-tenant integrity issue. The vulnerability was fixed in version 8.7.0 by removing the legacy importer entirely and replacing it with a new Livewire-based importer that enforces proper authorization checks.

## Affected products

- Snipe-IT Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory GHSA-2232-926w-qvr9 published
- 2026-09-09: disclosed: CVE-2026-86759 published
- 2026-09-09: patched: Fixed in version 8.7.0

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-2232-926w-qvr9](https://github.com/grokability/snipe-it/security/advisories/GHSA-2232-926w-qvr9)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-authorization-via-asset-history-csv-importer](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-missing-authorization-via-asset-history-csv-importer)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)