CVE-2026-86736 in Snipe-IT
Summary
by MITRE • 09/08/2026
snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a significant logic flaw within the asset management workflow, specifically affecting how checkout and cancellation operations are processed against internal counters. This issue stems from an incorrect calculation mechanism that fails to properly validate the state of existing requests before updating database records or incrementing specific counter variables. The core technical flaw lies in the application's failure to enforce strict idempotency checks or verify the existence of a pending request prior allowing destructive operations such as cancellation, and conversely failing to prevent duplicate submission attempts for checkout actions. This lack of state validation allows authenticated users to manipulate internal metrics that track asset availability and demand through repetitive API calls or interface interactions.
From an operational perspective, this vulnerability enables attackers with valid credentials to corrupt the assets.requests_counter by exploiting these unchecked logic paths. By repeatedly invoking cancellation endpoints without any corresponding active requests in progress, a malicious actor can drive the counter into negative values. Alternatively, submitting duplicate checkout requests for the same asset inflates the counter beyond its actual logical limit. These manipulations directly misrepresent the pending demand within the administrative queue, leading to inaccurate reporting on asset availability and potentially causing confusion or errors in inventory management processes that rely on these counters for decision-making regarding procurement or reallocation of resources.
The security implications extend beyond mere data corruption, as this behavior aligns with CWE-841 Improper Enforcement of Workflow Logic and CWE-362 Concurrent Execution using Shared Resource with Insufficient Synchronization if the counter updates are not atomic. The attack vector is classified under MITRE ATT&CK technique T1078 Valid Accounts, specifically focusing on Local Account abuse where an authenticated user leverages their privileges to disrupt system integrity rather than gaining unauthorized access. Since the vulnerability requires authentication, it highlights a critical gap in role-based access control and input validation for administrative functions that modify core inventory metrics.
Mitigation strategies must focus on implementing robust state verification before processing any checkout or cancellation requests. Developers should ensure that every attempt to cancel a request first verifies the existence of an active, non-cancelled request associated with the user and asset pair. Similarly, duplicate submission prevention mechanisms such as database-level unique constraints on pending requests or application-side locking mechanisms are essential to prevent counter inflation. Upgrading to Snipe-IT version 8.7.0 or later is required to resolve these logic flaws, as subsequent releases have implemented stricter validation rules for request handling workflows to ensure data consistency and accurate representation of asset demand in the administrative interface.