Quick answers
- Is CVE-2026-86765 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-86765 being exploited in the wild.
- How severe is CVE-2026-86765?
- Medium severity, with a CVSS score of 6.5, published 9 September 2026.
- Which products and versions are affected?
- Snipe Snipe-IT before 8.7.0.
- Is there a fix for CVE-2026-86765?
- A patch was published on 2026-07-25: Fix committed; version 8.7.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-86765 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-86765?
- Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Snipe-IT implements separate permissions for asset.edit and asset.checkout operations. The vulnerability exists in the PATCH /api/v1/hardware/{id} endpoint, which accepts assignment fields (assigned_user, assigned_asset, assigned_location) but fails to enforce checkout authorization before performing the assignment. When an edit-permitted user submits an assignment field, the endpoint resolves the target and invokes the checkout method without verifying checkout permission or requiring normal checkout eligibility checks. An attacker can therefore check out unassigned assets, reassign deployed assets between custodians, bypass required check-in transitions, and create fraudulent audit records—all while being denied direct checkout permission. The fix is available in version 8.7.0.
Affected products
- Snipe Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed
- 2026-07-25: patched: Fix committed; version 8.7.0 released