{"id":"CVE-2026-86739","title":"Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\\AcceptanceController::store()","summary":"Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\\AcceptanceController::store(). On filesystem drivers that return false instead of throw…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-252"],"vendor":"snipeitapp","product":"snipe-it","affected":["snipe-it < 8.7.0"],"patched":["snipe-it 8.7.0"],"published":"2026-09-09","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:19.093","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86739","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-h543-58f9-v6mj","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-acceptance-finalization-without-stored-evidence","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.0025,"epssPercentile":0.16688,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-18T17:10:26.971987Z"},"ingestedAt":"2026-09-13T02:39:29.697Z","slug":"CVE-2026-86739","body":"## Overview\n\nSnipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF in Account\\AcceptanceController::store(). On filesystem drivers that return false instead of throwing on a write failure (for example the local disk with restrictive permissions, S3 with expired credentials, or a storage backend that is out of quota), execution continues into $acceptance->accept(), which sets accepted_at and the signature_filename/eula_filename fields, creates the 'accepted' action-log entry, and dispatches completion notifications even though the evidence files were never stored. The result is an acceptance record marked complete whose supporting evidence files do not exist, yielding a materially incomplete compliance artifact for EULA acknowledgement or equipment-receipt workflows. The condition is triggered when an authenticated user completes an acceptance while the storage backend is silently failing writes; an attacker cannot directly force the storage backend into that state. Fixed in Snipe-IT 8.7.0.\n\n## Affected\n\n- `snipe-it < 8.7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snipe-it 8.7.0`","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}