Improper Ownership Management in Snipe-IT Consumables Checkout

Executive Summary

CVE-2026-86769 is an improper ownership management vulnerability in Snipe-IT versions before 8.7.0. It affects the consumables checkout API endpoint where the system records the checkout target user's ID instead of the authenticated caller's ID in the created_by column. This misattribution obscures which operator performed the action in audit trails.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review audit logs for inconsistencies in the consumables_users pivot table where the created_by field does not match the authenticated API caller. Check API call logs for POST requests to /api/v1/consumables/{id}/checkout and compare the user IDs in created_by with the actual authenticated user.

Useful 0 Not Useful 0

Impact Analysis

Authenticated attackers with consumables.checkout permission can exploit this to misattribute actions in the audit trail. This could lead to confusion about who performed specific actions, potentially hiding malicious activity or making it harder to trace accountability for consumable checkouts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by compromising audit trail integrity. Regulations like GDPR and HIPAA require accurate logging of user actions for accountability and non-repudiation. Misattributed actions may fail to meet these requirements, potentially leading to compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade Snipe-IT to version 8.7.0 or later to apply the official fix that corrects the created_by field to use auth()->id().
• Temporarily rely on the action_logs stream for accurate audit data until the upgrade is completed.
• Apply a SQL reconciliation query to retroactively correct historical pivot rows if needed.

Useful 0 Not Useful 0