# CVE-2026-86765: Snipe-IT authorization bypass in asset update endpoint

Source: https://junglewise.ai/threats/cve-2026-86765-snipe-it-authorization-bypass-in-asset-update-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86765 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Snipe-IT is an asset management system used to track and control hardware deployments across organizations. A flaw allows authenticated users who can edit assets but have been explicitly denied checkout permissions to reassign assets, transfer custody, and bypass check-in workflows through the asset update API. This circumvents intended access controls and audit procedures.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86765 being exploited in the wild.

**How severe is CVE-2026-86765?** Medium severity, with a CVSS score of 6.5, published 9 September 2026.

**Which products and versions are affected?** Snipe Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86765?** A patch was published on 2026-07-25: Fix committed; version 8.7.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86765 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-86765?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Snipe-IT implements separate permissions for asset.edit and asset.checkout operations. The vulnerability exists in the PATCH /api/v1/hardware/{id} endpoint, which accepts assignment fields (assigned_user, assigned_asset, assigned_location) but fails to enforce checkout authorization before performing the assignment. When an edit-permitted user submits an assignment field, the endpoint resolves the target and invokes the checkout method without verifying checkout permission or requiring normal checkout eligibility checks. An attacker can therefore check out unassigned assets, reassign deployed assets between custodians, bypass required check-in transitions, and create fraudulent audit records—all while being denied direct checkout permission. The fix is available in version 8.7.0.

## Affected products

- Snipe Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed
- 2026-07-25: patched: Fix committed; version 8.7.0 released

## References

- [https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206](https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-6g2g-83pc-6365](https://github.com/grokability/snipe-it/security/advisories/GHSA-6g2g-83pc-6365)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)