CVE-2026-86766

Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without locking the consumable row or re-checking availability. An authenticated user with permission to check out consumables can submit concurrent checkout requests for the same consumable so that both requests pass the availability check and succeed, over-allocating stock and driving the remaining inventory negative (e.g., a consumable with 1 remaining unit ends at -1 after two concurrent 1-unit checkouts). The issue is fixed in 8.7.0, which re-fetches the parent row under lockForUpdate inside the transaction and re-validates availability.

• CWE-362

• https://github.com/grokability/snipe-it/commit/f71806b1e0efbd3bc2b6be61994ad2a5d5d6c206
• https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm
• https://www.vulncheck.com/advisories/snipe-it-8.6.3-race-condition-via-consumable-checkout
• https://github.com/grokability/snipe-it/security/advisories/GHSA-x4g2-87xc-m5jm

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86760Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) conta…5.4
• CVE-2026-86761snipe-it versions before 8.7.0 contain an authorization bypa…4.3
• CVE-2026-86762Snipe-IT before 8.7.0 does not apply the CheckUserIsActivate…8.1
• CVE-2026-86763Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authoriz…3.5
• CVE-2026-86764Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the…6.5
• CVE-2026-86765Snipe-IT versions before 8.7.0 fail to enforce checkout auth…6.5
• CVE-2026-86767Snipe-IT versions before 8.7.0 fail to apply company scope f…5
• CVE-2026-86768Snipe-IT before 8.7.0 fails to validate soft-deleted state i…5.4
• CVE-2026-86769Snipe-IT versions before 8.7.0 contain an improper ownership…4.3
• CVE-2026-8677The Prime Elementor Addons – Lightweight Elementor Widgets f…6.4
• CVE-2026-86770Snipe-IT before 8.7.0 fails to validate username case sensit…8.1
• CVE-2026-86771Snipe-IT versions before 8.7.0 fail to HTML-escape the emplo…7.6