Snipe-IT before version 8.7.0 does not check whether target resources are soft-deleted when processing checkout API calls. An authenticated user with checkout rights can send POST requests to the hardware, component, or consumable endpoints using IDs of users, assets, or locations that have been soft-deleted. The server accepts these requests and creates references that point to non-existent or inactivated entities, rendering the asset ledger and audit trails inaccurate and potentially orphaned.

This flaw affects deployments of Snipe-IT running any release prior to 8.7.0. The vulnerability is present in all product editions that offer API checkout functionality, regardless of the operating environment or database backend.

The CVSS score of 5.3 indicates moderate impact. The exploit requires an authenticated user with checkout permissions, so the attack vector is likely internal or via compromised API credentials. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of active exploitation. Nonetheless, the potential for corruption of inventory data and audit logs makes it a concern for organizations that rely on accurate asset tracking.