Read the docs
TI-2026-59301 Aliases CVE-2026-86744GHSA-q6gf-g3vm-vprw

snipe-it before 8.7.0 Race Condition in Asset Checkout

Priority LOW 11CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without taking a row lock or re-checking availability, so two concurrent checkout requests for the same available asset can both observe it as available and both commit. This produces duplicate checkout-history rows, a doubled checkout_counter, and two CheckoutableCheckedOut events for a single-assignment asset, corrupting the audit trail and utilization/reconciliation reporting; the asset's final assigned_to remains singular, so the visible assignment stays intact. Exploitation requires an authenticated session holding the assets.checkout permission (or superuser) and precise concurrent timing. Fixed in 8.7.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed snipe-it (grokability): 8.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
grokabilitysnipe-itbefore 8.7.08.7.0Patch availableCNA
  • snipe-it Vendorgrokability Affected before 8.7.0 Fixed in 8.7.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*before 8.7.0Vulnerablegrokability
  • cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.7.0 Vulnerable ·grokability

Remediation

  • Fix · CNA snipe-it (grokability) Fixed in 8.7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    grokability snipe-it 8.7.0

    33 records Highest priority Priority HIGH 5 HIGH, 8 MEDIUM, 20 LOW

    Other records, highest priority first

    • TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationPriority HIGH 72
    • TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via MarkdownPriority HIGH 70
    • TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULAPriority HIGH 70
    Show all 33 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86744
  2. 2026-10-03 Alias added: GHSA-q6gf-g3vm-vprw

References

Exploit 1

Patch 1

  • TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
  • TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
  • TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
  • TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
  • TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
  • TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
See all 134 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences