CVE-2026-86759

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86765

Snipe-IT versions prior to 8.7.0 are affected by an authorization bypass in the asset update endpoint (PATCH /api/v1/hardware/{id} ). The root cause is a failure to enforce checkout authorization when assignment parameters (assigned_user, assigned_asset, or assigned_location) are submitted. An au...

CVE-2026-86765 Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users with edit permission but explicitly denied checkout permission can reassign assets, bypass check-in procedures, and alter custody records by...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

PT-2026-89028

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authorization failure exists in the 'POST /hardware/history' endpoint, which allows any authenticated user to reassign arbitrary assets and modify audit logs. By submitting a CSV file, an attacke...

PT-2026-89034

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description Authenticated users with edit permissions but without checkout permissions can bypass authorization checks when updating assets. By sending specific parameters to the 'PATCH /api/v1/hardware/id'...