# CVE-2026-86769: Snipe-IT improper ownership management in consumables checkout API

Source: https://junglewise.ai/threats/cve-2026-86769-snipe-it-improper-ownership-management-in-consumables-checkout  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86769 · Severity: medium · CVSS 4.3 · Published 2026-09-09

Snipe-IT is an asset inventory management platform used to track corporate equipment and consumables. A bug in the consumables checkout API endpoint records the wrong person's ID in audit logs, making it unclear which employee actually approved a checkout. An authenticated user with proper permissions can trigger this audit-log misattribution on any consumable checkout they're authorized to perform.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86769 being exploited in the wild.

**How severe is CVE-2026-86769?** Medium severity, with a CVSS score of 4.3, published 9 September 2026.

**Which products and versions are affected?** Grokability Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-86769?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86769 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86769?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ConsumablesController::checkout() API endpoint, which uses an improper ownership management pattern (CWE-282). When processing a POST /api/v1/consumables/{id}/checkout request, the code sets the created_by column in the consumables_users pivot table to the checkout target user's ID instead of the authenticated API caller's ID. The vulnerability requires a valid API token with consumables.checkout permission; no authorization bypass is present. An attacker can execute this with a single API call. The impact is limited to audit-trail integrity—the action_logs stream correctly records the authenticated actor, but the pivot-table audit surface shows misattributed provenance. The fix, applied in version 8.7.0, changes created_by to auth()->id() instead of the target user's ID.

## Affected products

- Grokability Snipe-IT before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory (GHSA-x9p8-vvc5-q754) published
- 2026-09-09: advisory: CVE-2026-86769 published on NVD

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-x9p8-vvc5-q754](https://github.com/grokability/snipe-it/security/advisories/GHSA-x9p8-vvc5-q754)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-audit-log-misattribution-via-consumables-checkout](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-audit-log-misattribution-via-consumables-checkout)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)