---
id: CVE-2026-86734
title: >-
  Snipe-IT before 8.7.1 fails to validate the length of the note field in the
  POST /account/accept/{acceptance} endpoint, allowing authenticated users to
  submit unbounded input that reaches synchronous CommonMark rendering
summary: >-
  Snipe-IT before 8.7.1 fails to validate the length of the note field in the
  POST /account/accept/{acceptance} endpoint, allowing authenticated users to
  submit unbounded input that reaches synchronous CommonMark rendering.
  Attackers can s…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.1
patched:
  - snipe-it 8.7.1
published: '2026-09-08'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:18:04.020'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86734'
references:
  - url: >-
      https://github.com/grokability/snipe-it/commit/66770cfe20cb135e2b7022c7a83d01e6783c914a
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-4vcv-fc5x-jjwv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.1-denial-of-service-via-unbounded-note-field
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T14:18:53.642578Z'
epss: 0.00548
epssPercentile: 0.43462
ingestedAt: '2026-09-08T15:33:26.987Z'
---

## Overview

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.

## Affected

- `snipe-it < 8.7.1`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.1`