CVE-2026-86759 — Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attacke…
Published: 2026-09-09 · CVSS: 7.1 · CVSS 4.0
Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify audit logs. Attackers can submit a CSV file to reassign assets across companies and inject fraudulent audit trail entries, compromising inventory integrity and accountability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7