# CVE-2026-86768: Snipe-IT API checkout endpoints improper input validation

Source: https://junglewise.ai/threats/cve-2026-86768-snipe-it-api-checkout-endpoints-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86768 · Severity: medium · CVSS 5.4 · Published 2026-09-09

Snipe-IT is an open-source asset management system used by organizations to track hardware, components, and consumables. A flaw in its REST API checkout endpoints allows authenticated IT operators to assign live inventory items to deleted users, assets, or locations, creating broken references that corrupt the asset ledger, audit trails, and reporting functionality—undermining the integrity of the system's core business function.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86768 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86768 being exploited in the wild.

**How severe is CVE-2026-86768?** Medium severity, with a CVSS score of 5.4, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT 8.6.3 and earlier; patched in 8.7.0.

**Is there a fix for CVE-2026-86768?** A patch was published on 2026-09-09: Version 8.7.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86768 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86768?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw (CWE-20) in three Snipe-IT API checkout endpoints: POST /api/v1/hardware/{id}/checkout, POST /api/v1/components/{id}/checkout, and POST /api/v1/consumables/{id}/checkout. The endpoints use Laravel's withoutGlobalScopes()->find() to resolve target entities (users, assets, locations), which intentionally bypasses the SoftDeletes global scope to provide better error messaging. However, no post-lookup validation of the deleted_at timestamp was implemented, allowing checkout operations to reference soft-deleted targets. The attack requires network access and valid authentication with checkout permissions (low privilege). An attacker can submit POST requests with soft-deleted IDs to create orphaned foreign key references that corrupt the asset assignment ledger and audit trails. The vulnerability was patched in version 8.7.0; versions through 8.6.3 are affected.

## Affected products

- Snipe-IT Snipe-IT 8.6.3 and earlier; patched in 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub security advisory GHSA-qffp-xpqv-gqr4 published
- 2026-09-09: patched: Version 8.7.0 released with fix

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4](https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-improper-input-validation-via-api-checkout](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-improper-input-validation-via-api-checkout)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)