Snipe-IT Privilege Escalation via Asset Reassignment

Executive Summary

CVE-2026-86765 is an authorization bypass flaw in Snipe-IT versions before 8.7.0. Authenticated users with edit permissions but denied checkout permissions can exploit the asset update endpoint to reassign assets, bypass check-in procedures, and alter custody records by submitting specific parameters like assigned_user or assigned_location.

Useful 0 Not Useful 0

Detection Guidance

Check Snipe-IT version with: curl -s https://your-snipe-it-url.com/api/v1/about | grep version. If version is below 8.7.0, the system is vulnerable. Monitor API logs for PATCH requests to /api/v1/hardware/{id} containing assigned_user, assigned_asset, or assigned_location parameters from users without checkout permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to reassign assets between users, assign non-deployable assets, manipulate checkout counters and timestamps, and corrupt the asset custody audit trail. It undermines financial controls, compliance reporting, and regulatory evidence by bypassing required workflows.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability can impact compliance by enabling unauthorized asset transfers and falsified custody records, which may violate audit requirements, financial controls, and regulatory evidence standards. It undermines separation of duties and data integrity, potentially leading to non-compliance with GDPR, HIPAA, or other frameworks requiring accurate asset tracking and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Review user permissions to ensure users with edit rights do not have checkout permissions revoked. Audit recent asset assignments via admin panel to identify unauthorized changes.

Useful 0 Not Useful 0