CVE-2026-86759

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86765

Snipe-IT versions prior to 8.7.0 are affected by an authorization bypass in the asset update endpoint (PATCH /api/v1/hardware/{id} ). The root cause is a failure to enforce checkout authorization when assignment parameters (assigned_user, assigned_asset, or assigned_location) are submitted. An au...

CVE-2026-86759 Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...

CVE-2026-86759

Snipe-IT versions before 8.7.0 are affected by a missing authorization flaw in the POST /hardware/history endpoint. Any authenticated user can submit a CSV file to reassign arbitrary assets across companies and inject fraudulent audit trail entries , compromising inventory integrity and accountab...

EUVD-2026-74936

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising...