CVE-2026-86768

5.3 mediumEPSS 0.3%

Medium (5.3) in snipeitapp snipe-it. EPSS 0.3% chance of exploitation in the next 30 days.

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2026-09-09
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19

Affected

snipeitapp:snipe-it

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-improper-input-validation-via-api-checkout
https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4

Check your stack JSON