CVE-2026-86736 Snipeitapp CVE debrief

Who should care

Defenders who manage Snipe-It installations, particularly those with authenticated users who can submit checkout requests, should assess exposure and prioritize verification and remediation.

Why it matters

CVE-2026-86736 is a medium-severity vulnerability in Snipe-It before version 8.7.0 that allows authenticated users to corrupt the assets.requests_counter, potentially leading to inaccurate representation of pending demand in the admin queue. Defenders who manage Snipe-It installations, particularly those with authenticated users who can submit checkout requests, should assess exposure and prioritize verification and remediation.

• Potential corruption of the assets.requests_counter may lead to inaccurate representation of pending demand in the admin queue.
• Authenticated users may be able to repeatedly call cancel endpoints without active requests to drive the counter negative.
• Authenticated users may be able to submit duplicate checkout requests to inflate the counter.

Technical summary

The vulnerability is caused by an incorrect calculation in the checkout request handling, allowing authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. This can be exploited by repeatedly calling cancel endpoints without active requests to drive the counter negative or submitting duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue. Defenders should prioritize verifying and upgrading to version 8.7.0 or later to prevent potential corruption of the assets.requests_counter.

Defensive priority

Defenders should prioritize verifying and upgrading to version 8.7.0 or later to prevent potential corruption of the assets.requests_counter.

Recommended defensive actions

• Verify and upgrade to version 8.7.0 or later
• Monitor for duplicate submissions and cancellations without active requests
• Restrict access to checkout request handling for authenticated users
• Review system logs for suspicious activity
• Perform a thorough review of Snipe-It configurations and user access
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The source references include a Vendor Advisory and a Third Party Advisory. Evidence is limited to public CVE and NVD information. Defenders should verify Snipe-It version and review system logs for suspicious activity. Additional verification may be required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.