Executive brief
Snipe-IT is an asset inventory management platform used to track corporate equipment and consumables. A bug in the consumables checkout API endpoint records the wrong person's ID in audit logs, making it unclear which employee actually approved a checkout. An authenticated user with proper permissions can trigger this audit-log misattribution on any consumable checkout they're authorized to perform.
Technical details
The vulnerability exists in the ConsumablesController::checkout() API endpoint, which uses an improper ownership management pattern (CWE-282). When processing a POST /api/v1/consumables/{id}/checkout request, the code sets the created_by column in the consumables_users pivot table to the checkout target user's ID instead of the authenticated API caller's ID. The vulnerability requires a valid API token with consumables.checkout permission; no authorization bypass is present. An attacker can execute this with a single API call. The impact is limited to audit-trail integrity—the action_logs stream correctly records the authenticated actor, but the pivot-table audit surface shows misattributed provenance. The fix, applied in version 8.7.0, changes created_by to auth()->id() instead of the target user's ID.
Affected products
- Grokability Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory (GHSA-x9p8-vvc5-q754) published
- 2026-09-09: advisory: CVE-2026-86769 published on NVD