CVE-2026-86759 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical failure in access control mechanisms within the application's asset management module. Specifically, the POST endpoint for /hardware/history lacks proper authorization checks that restrict operations based on user roles or organizational boundaries. This flaw allows any authenticated user, regardless of their privilege level, to interact with this endpoint without verifying whether they have permission to modify assets belonging to other companies or entities within a multi-tenant environment. The absence of these controls means that the application trusts client-supplied data regarding asset ownership and assignment history without validating it against server-side access policies.
From a technical perspective, the exploitation vector involves submitting crafted HTTP POST requests containing CSV-formatted data to the vulnerable endpoint. By manipulating fields such as assigned user or company ID in the payload, an attacker can force the system to reassign hardware assets from one organizational unit to another without authorization. This capability bypasses standard workflow approvals and audit trails that are typically required for significant inventory changes. The ability to modify these records directly undermines the integrity of the asset tracking process, as the system accepts arbitrary assignments that do not reflect actual physical or logical ownership transfers.
The operational impact of this vulnerability is severe, particularly in environments where Snipe-IT serves multiple distinct organizations through a single instance. Attackers can reassign critical hardware assets to unauthorized users or entities, leading to potential loss of control over sensitive equipment. Furthermore, the ability to inject fraudulent audit trail entries allows adversaries to cover their tracks by creating false records that suggest legitimate transactions occurred at specific times with authorized personnel. This compromises accountability and makes forensic analysis difficult, as the historical record becomes unreliable for compliance reporting and incident response investigations.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, specifically where a user is able to perform actions beyond their intended permissions due to insufficient authorization checks on API endpoints. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1078, Valid Accounts, as the attacker leverages legitimate credentials to access resources they should not have permission to modify. It also relates to T1562, Impair Defenses, by manipulating audit logs to obscure malicious activity and evade detection mechanisms that rely on accurate historical data for anomaly detection.
To mitigate this risk, organizations running Snipe-IT must immediately upgrade to version 8.7.0 or later, where the authorization logic has been corrected to enforce strict checks on asset reassignment operations. Until an upgrade is feasible, administrators should implement network-level controls such as Web Application Firewalls that monitor for unusual patterns in POST requests to the /hardware/history endpoint. Additionally, reviewing existing audit logs for inconsistencies can help identify potential exploitation attempts that may have occurred prior to patching. Regular audits of user permissions and asset assignments are recommended to ensure that no unauthorized changes persist within the system inventory records.