Snipe‑IT versions prior to 8.7.0 allow an authenticated user who has edit permissions but is explicitly denied checkout authorization to change the asset’s assignment fields. By submitting the assigned_user, assigned_asset, or assigned_location parameters to the asset update API, the attacker can reassign assets without completing the required checkout process, effectively bypassing custody controls and deteriorating the integrity of asset tracking. This is a CWE-862 Permission Management weakness.

The vulnerability affects installations of Snipe‑IT earlier than version 8.7.0, including the 8.6.3 release. The affected product is the Snipe‑IT asset management application provided by grokability.

The CVSS score of 7.1 indicates a high risk level; however, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated account with edit privileges but lacking checkout rights; the attacker must have legitimate access to the system, making it an insider or legitimate user threat. Exploitation would allow unauthorized asset reassignment and potential fraudulent movement of physical assets.