Which versions of Snipe-IT are affected by CVE-2026-86759?

Snipe-IT versions before 8.7.0 contain an authorization flaw allowing authenticated users to reassign IT assets and tamper with audit logs, undermining asset accountability and compliance audit…. A patch is available.

How to fix or mitigate CVE-2026-86759?

Within 24 hours, identify all Snipe-IT installations and document their current versions. Within 7 days, upgrade all affected instances to Snipe-IT 8.7.0 or later and restrict administrative access to the POST /hardware/history endpoint to authorized asset management personnel only. Within 30 days, audit asset transfer records and audit logs from before patch deployment to detect unauthorized transfers, investigate findings with finance and internal audit, and validate asset ownership records against financial system records.

Snipe-IT CVE-2026-86759

Q: What is the CVSS score of CVE-2026-86759?

CVE-2026-86759 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-74936 HIGH

Missing Authorization (CWE-862)

2026-09-09 VulnCheck

GHSA-23j2-r96m-7fq9

Snipe It Grokability

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-reachable endpoint requires only a low-privilege authenticated session; high integrity impact from audit log and asset manipulation; minimal availability impact from inventory disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 09, 2026 - 15:40 vuln.today

tag: Authentication Bypass removed

POC Analysis Generated

Sep 09, 2026 - 15:25 vuln.today

Analysis Generated

Sep 09, 2026 - 14:43 vuln.today

Patch available

Sep 09, 2026 - 14:19 EUVD

CVE Published

Sep 09, 2026 - 13:32 cve.org

HIGH 7.1

DescriptionCVE.org

Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.

AnalysisAI

Missing authorization on the POST /hardware/history endpoint in Snipe-IT before 8.7.0 allows any authenticated user to reassign arbitrary assets and inject fabricated entries into audit logs. By submitting a crafted CSV payload, a low-privileged attacker can silently transfer assets across organizational boundaries and corrupt the audit trail, undermining inventory accountability and chain-of-custody integrity. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid Snipe-IT account at any privilege level - no administrative role or elevated permissions are needed, only an active authenticated session (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L) and resulting score of 7.1 accurately capture the risk profile: network-reachable, low complexity, low-privilege exploitation with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Snipe-IT 8.7.0 or later, which resolves the missing authorization check on the POST /hardware/history endpoint. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Snipe-IT installations and document their current versions. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Snipe It

View all

CVE-2023-5511 HIGH This Week POC

8.8 Oct 11

Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. Rated high severity (CVSS 8.8),

CVE-2022-23064 HIGH This Week POC

8.8 May 02

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. Rated high severity (CVSS 8.8), this

CVE-2021-4130 HIGH This Week POC

8.8 Dec 18

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remot

CVE-2021-3858 HIGH This Week POC

8.8 Oct 19

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remot

CVE-2022-2997 HIGH This Week POC

8.0 Aug 25

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. Rated high severity (CVSS 8.0), this vulnerability

CVE-2022-1155 HIGH This Week POC

7.4 Mar 30

Old sessions are not blocked by the login enable function. Rated high severity (CVSS 7.4), this vulnerability is remotel

CVE-2021-4075 HIGH This Week POC

7.2 Dec 06

snipe-it is vulnerable to Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.2), this vulnerability is remo

CVE-2026-48507 HIGH This Week POC

7.1 Jun 08

Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding

CVE-2024-48987 MEDIUM This Month POC

6.6 Oct 11

Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the AP

CVE-2022-1511 MEDIUM This Month POC

6.5 Apr 28

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. Rated medium severity (CVSS 6.5), this vulnera

CVE-2021-4108 MEDIUM This Month POC

6.1 Dec 14

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated me

CVE-2021-3863 MEDIUM This Month POC

6.1 Oct 19

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated me

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2025-20362 HIGH POC

8.6

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2020-36719 CRITICAL POC

9.8

CVE-2026-86759 vulnerability details – vuln.today

Back

Snipe-IT CVE-2026-86759

Severity by source

CVSS VectorVendor: VulnCheck

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Snipe It

Same weakness CWE-862 – Missing Authorization

Share

External POC / Exploit Code