CVE-2026-86736CWE-682

CVE-2026-86736

Medium · published September 8, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
21.3
In the wild
Unconfirmed
What it is

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00298 · 21.3th percentile
Weakness
CWE-682 · Incorrect Calculation
Published
2026-09-08T20:18Z
Affected products (1)
ProductVersionsFixed in
snipeitapp/snipe-it< 8.7.08.7.0
References (2)
https://github.com/grokability/snipe-it/security/advisories/GHSA-hc9q-5x9h-9gxc · [email protected]https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-checkout-request-counter-integrity-failure · [email protected]
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 15:14Z
    snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
    cvelistv5