CVE-2026-86739

Analyzed Analyzed - Analysis Complete

Signature File Write Failure in Snipe-IT Leads to Incomplete Compliance Records

Publication date: 2026-09-09

Last updated on: 2026-09-18

Assigner: VulnCheck

Description

Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a storage backend that is out of quota), execution continues into $acceptance->accept(), which sets accepted_at and the signature_filename/eula_filename fields, creates the 'accepted' action-log entry, and dispatches completion notifications even though the evidence files were never stored. The result is an acceptance record marked complete whose supporting evidence files do not exist, yielding a materially incomplete compliance artifact for EULA acknowledgement or equipment-receipt workflows. The condition is triggered when an authenticated user completes an acceptance while the storage backend is silently failing writes; an attacker cannot directly force the storage backend into that state. Fixed in Snipe-IT 8.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-18

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-86739

EUVD

EUVD-2026-74916

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

CVE-2026-86739 affects Snipe-IT versions 8.6.3 and earlier. It involves the AcceptanceController::store() function failing to check if file storage operations succeed when saving signatures or PDFs. If writes fail silently due to permissions, expired credentials, or quota limits, the system still marks the acceptance as complete and logs it, creating records without actual evidence files.

Detection Guidance

Check Snipe-IT version with: grep -r "version" config/app.php. If version is 8.6.3 or earlier, the system is vulnerable. Inspect storage backend logs for failed write operations during acceptance finalization. Verify acceptance records have corresponding signature PNG and PDF files in storage paths.

Impact Analysis

This vulnerability can lead to fraudulent compliance records. If your organization uses Snipe-IT for EULA acknowledgments or equipment receipts, acceptance records may appear valid but lack the required supporting files, potentially causing legal or operational issues if audited.

Compliance Impact

This vulnerability can undermine compliance with GDPR, HIPAA, or other regulations requiring verifiable records. Acceptance records without stored evidence files may fail audits, as they lack proof of actual acknowledgment or receipt, potentially violating record-keeping requirements.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Ensure storage backend permissions and credentials are valid and not expired. Monitor acceptance records to confirm evidence files exist for all completed acceptances.

Hi! I’m here to help you understand CVE-2026-86739. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70