---
id: CVE-2026-86769
title: >-
  Snipe-IT versions before 8.7.0 contain an improper ownership management
  vulnerability in the consumables checkout API endpoint that records the
  checkout target user's id in the created_by column instead of the
  authenticated caller's id
summary: >-
  Snipe-IT versions before 8.7.0 contain an improper ownership management
  vulnerability in the consumables checkout API endpoint that records the
  checkout target user's id in the created_by column instead of the
  authenticated caller's id. …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-282
vendor: snipeitapp
product: snipe-it
affected:
  - snipe-it < 8.7.0
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T01:16:31.160'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86769'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-x9p8-vvc5-q754
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-audit-log-misattribution-via-consumables-checkout
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-20T00:07:33.339837Z'
epss: 0.00276
epssPercentile: 0.17883
ingestedAt: '2026-09-12T18:49:38.763Z'
---

## Overview

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables_users pivot table, obscuring which operator performed the action.

## Affected

- `snipe-it < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`