Improper Enforcement of Behavioral Workflow in snipe-it - CVE-2026-86765
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote user to modify asset custody records and bypass checkout workflow restrictions.
The vulnerability exists due to improper enforcement of behavioral workflow in the PATCH /api/v1/hardware/{asset_id} asset update endpoint when processing assignment fields in asset update requests. A remote user can submit a specially crafted PATCH request with assigned_user, assigned_asset, or assigned_location fields to modify asset custody records and bypass checkout workflow restrictions.
The issue can be exploited by an authenticated account with asset view and edit permissions but without checkout or check-in permissions, and it can overwrite an existing assignment without an intervening check-in.