SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-86768

MEDIUM · CVSS 5.4 EPSS 0.23% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-09 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

Snipe-IT versions prior to 8.7.0 are vulnerable due to inadequate validation of soft-deleted states in API checkout endpoints, enabling authenticated users with checkout permissions to associate live inventory with deleted entities. This flaw can lead to the creation of orphaned references, resulting in corruption of the asset ledger and audit trails. Organizations using Snipe-IT should prioritize updating to version 8.7.0 or later to mitigate potential data integrity issues.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86768
Severity
MEDIUM
CVSS
5.4
EPSS
0.23%

Original NVD Description

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.