CVE-2026-86766

Undergoing Analysis Undergoing Analysis - In Progress

Race Condition in Snipe-IT Consumable Checkout API

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: VulnCheck

Description

Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without locking the consumable row or re-checking availability. An authenticated user with permission to check out consumables can submit concurrent checkout requests for the same consumable so that both requests pass the availability check and succeed, over-allocating stock and driving the remaining inventory negative (e.g., a consumable with 1 remaining unit ends at -1 after two concurrent 1-unit checkouts). The issue is fixed in 8.7.0, which re-fetches the parent row under lockForUpdate inside the transaction and re-validates availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86766

EUVD

EUVD-2026-74943

Affected Vendors & Products

Vendor	Product	Version / Range
grokability	snipe-it	to 8.6.3 (inc)
snipe-it	snipe-it	to 8.6.3 (inc)
snipe-it	snipe-it	8.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

CVE-2026-86766 is a race condition (TOCTOU) in Snipe-IT versions up to 8.6.3 affecting the consumable checkout API. The system checks available stock before starting a transaction but does not lock the consumable row or re-validate during the transaction. This allows concurrent requests to over-allocate stock, leading to negative inventory counts.

Detection Guidance

To detect this vulnerability, monitor for negative inventory counts in Snipe-IT consumables. Check API logs for concurrent checkout requests to the same consumable ID. Look for failed transactions or errors in the checkout process that indicate over-allocation attempts.

Impact Analysis

An authenticated user with checkout permissions can exploit this to over-allocate consumable inventory by submitting concurrent requests. This corrupts inventory records, allocates non-existent stock, and undermines procurement processes. The impact includes incorrect stock levels and potential disruptions in inventory management.

Compliance Impact

This vulnerability could impact compliance with standards requiring accurate inventory tracking and data integrity, such as HIPAA for healthcare assets or GDPR for data management. Over-allocation of consumables due to race conditions may lead to incorrect asset records, potentially violating audit trails or inventory accuracy requirements.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later to apply the fix. If immediate upgrade is not possible, restrict concurrent checkout permissions or implement rate limiting on the consumable checkout API endpoint to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2026-86766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70