Description
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Published: 2026-09-09
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Inventory Modification
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows any authenticated user to use the POST /hardware/history endpoint to reassign assets and modify audit logs without proper authorization checks. By submitting a specially crafted CSV file, an attacker can reassign assets to other companies and inject fraudulent audit trail entries, eroding inventory integrity and accountability.

Affected Systems

The affected product is Snipe‑IT, a web‑based asset management application from the vendor Snipe‑IT. All releases before 8.7.0 are susceptible; versions 8.7.0 and later include the fix.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity for this missing authorization flaw. EPSS for this vulnerability is not available, and it is not listed in the CISA KEV catalog, yet the potential impact on inventory accountability is severe. Based on the description, the likely attack vector is an authenticated user exploiting the CSV importer endpoint; an attacker must first have valid credentials to use the interface.

Generated by OpenCVE AI on September 9, 2026 at 15:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Snipe‑IT release (>=8.7.0) to restore proper authorization checks on the history import endpoint.
  • Configure the POST /hardware/history route to allow only admin or privileged users, and enforce strict validation of uploaded CSV files.
  • Review existing audit logs and asset records for unauthorized changes, and revert or flag any tampered entries.
  • If an immediate upgrade is not feasible, disable the CSV import functionality or lock the /hardware/history endpoint until the patch is applied.

Generated by OpenCVE AI on September 9, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Grokability
Grokability snipe-it
Vendors & Products Grokability
Grokability snipe-it

Wed, 09 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Description Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Title Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
First Time appeared Snipeitapp
Snipeitapp snipe-it
Weaknesses CWE-862
CPEs cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Vendors & Products Snipeitapp
Snipeitapp snipe-it
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Grokability Snipe-it
Snipeitapp Snipe-it
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-20T00:35:32.809Z

Reserved: 2026-09-08T11:33:02.641Z

Link: CVE-2026-86759

cve-icon Vulnrichment

Updated: 2026-09-20T00:31:13.071Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T14:17:25.593

Modified: 2026-09-20T01:16:30.887

Link: CVE-2026-86759

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-10T17:15:06Z

Weaknesses