Is CVE-2026-86769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86769 being exploited in the wild.

How severe is CVE-2026-86769?

Medium severity, with a CVSS score of 4.3, published 9 September 2026.

Which products and versions are affected?

Grokability Snipe-IT before 8.7.0.

Is there a fix for CVE-2026-86769?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86769 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86769?

Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86769: Snipe-IT improper ownership management in consumables checkout API

CVE-2026-86769 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Snipe-IT is an asset inventory management platform used to track corporate equipment and consumables. A bug in the consumables checkout API endpoint records the wrong person's ID in audit logs, making it unclear which employee actually approved a checkout. An authenticated user with proper permissions can trigger this audit-log misattribution on any consumable checkout they're authorized to perform.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86769 being exploited in the wild.
How severe is CVE-2026-86769?: Medium severity, with a CVSS score of 4.3, published 9 September 2026.
Which products and versions are affected?: Grokability Snipe-IT before 8.7.0.
Is there a fix for CVE-2026-86769?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86769 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86769?: Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the ConsumablesController::checkout() API endpoint, which uses an improper ownership management pattern (CWE-282). When processing a POST /api/v1/consumables/{id}/checkout request, the code sets the created_by column in the consumables_users pivot table to the checkout target user's ID instead of the authenticated API caller's ID. The vulnerability requires a valid API token with consumables.checkout permission; no authorization bypass is present. An attacker can execute this with a single API call. The impact is limited to audit-trail integrity—the action_logs stream correctly records the authenticated actor, but the pivot-table audit surface shows misattributed provenance. The fix, applied in version 8.7.0, changes created_by to auth()->id() instead of the target user's ID.

Affected products

Grokability Snipe-IT before 8.7.0

Timeline

2026-08-24: disclosed: GitHub Security Advisory (GHSA-x9p8-vvc5-q754) published
2026-09-09: advisory: CVE-2026-86769 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.