# CVE-2026-86766: Snipe-IT consumable checkout race condition

Source: https://junglewise.ai/threats/cve-2026-86766-snipe-it-consumable-checkout-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86766 · Severity: medium · CVSS 6.5 · Published 2026-09-09

Snipe-IT is an asset and inventory management system used by organizations to track consumable supplies like office equipment and materials. A race condition in the consumable checkout API allows authenticated users to simultaneously request the same items, causing both requests to succeed even when insufficient stock exists, resulting in negative inventory balances that corrupt stock records and undermine procurement workflows.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86766 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86766 being exploited in the wild.

**How severe is CVE-2026-86766?** Medium severity, with a CVSS score of 6.5, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT up to and including 8.6.3.

**Is there a fix for CVE-2026-86766?** A patch was published on 2026-07-25: Fix released in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86766 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86766?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-of-check-time-of-use (TOCTOU) race condition exists in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The vulnerability occurs because availability validation happens before the database transaction begins, and the transaction does not re-lock or re-validate the consumable row. An authenticated attacker with checkout permissions can submit concurrent requests for the same consumable; both requests observe the same inventory count, pass validation, and succeed, driving inventory negative. The fix (included in version 8.7.0) re-fetches the consumable row under a row-level lock (lockForUpdate) inside the transaction and re-validates availability before completing the checkout.

## Affected products

- Snipe-IT Snipe-IT up to and including 8.6.3

## Timeline

- 2026-08-24: disclosed
- 2026-07-25: patched: Fix released in version 8.7.0
- 2026-09-09: advisory

## References

- [https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206](https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206)
- [https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm](https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)