---
id: CVE-2026-86736
title: >-
  snipe-it before 8.7.0 contains an incorrect calculation vulnerability in
  checkout request handling that allows authenticated users to corrupt the
  assets.requests_counter through duplicate submissions and cancellations
  without active requ…
summary: >-
  snipe-it before 8.7.0 contains an incorrect calculation vulnerability in
  checkout request handling that allows authenticated users to corrupt the
  assets.requests_counter through duplicate submissions and cancellations
  without active requ…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-682
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-08'
updated: '2026-09-19'
sourceUpdated: '2026-09-19T15:17:07.017'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86736'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-hc9q-5x9h-9gxc
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-checkout-request-counter-integrity-failure
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00298
epssPercentile: 0.20025
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:43:11.832631Z'
ingestedAt: '2026-09-08T15:33:26.987Z'
---

## Overview

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`