CVE-2026-86744

Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() outside the mutation path and then invoke Asset::checkOut() without taking a row lock or re-checking availability, so two concurrent checkout requests for the same available asset can both observe it as available and both commit. This produces duplicate checkout-history rows, a doubled checkout_counter, and two CheckoutableCheckedOut events for a single-assignment asset, corrupting the audit trail and utilization/reconciliation reporting; the asset's final assigned_to remains singular, so the visible assignment stays intact. Exploitation requires an authenticated session holding the assets.checkout permission (or superuser) and precise concurrent timing. Fixed in 8.7.0.

• CWE-362

• https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206
• https://github.com/grokability/snipe-it/security/advisories/GHSA-h992-9438-26v8
• https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-race-condition-in-asset-checkout

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86738Snipe-IT versions before 8.7.0 contain a CSS injection vulne…8.7
• CVE-2026-86739Snipe-IT 8.6.3 and earlier do not check the return value of …3.1
• CVE-2026-86740Snipe-IT before 8.7.0 fails to check the return value of Sto…3.8
• CVE-2026-86741Snipe-IT versions before 8.7.0 fail to sanitize the category…8.5
• CVE-2026-86742Snipe-IT through 8.6.3 does not neutralize formula elements …6.5
• CVE-2026-86743Snipe-IT versions before 8.7.0 fail to properly scope asset …5
• CVE-2026-86745Snipe-IT is an IT asset management application. In Snipe-IT …6.5
• CVE-2026-86746Snipe-IT before 8.7.0 contains an authorization bypass vulne…6.4
• CVE-2026-86747Snipe-IT is an open source IT asset management system. In ve…5.4
• CVE-2026-86748Snipe-IT versions before 8.7.0 wipe the database before vali…6.1
• CVE-2026-86749Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the…6.3
• CVE-2026-86750Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate …7.7