Snipe-IT before version 8.7.1 fails to enforce length validation on the note field submitted via the POST /account/accept/{acceptance} endpoint. This allows authenticated users to provide unbounded input that is processed synchronously by the CommonMark markdown renderer. The processing of large inputs can exhaust PHP worker CPU resources, causing a denial of service condition through resource exhaustion in the markdown parsing pipeline.

The vulnerability enables authenticated users to cause denial of service by submitting large note values that consume excessive CPU resources during markdown rendering. This can degrade or disrupt service availability for legitimate users. There is no indication of privilege escalation, data disclosure, or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit the size of note inputs at the application or web server level if possible, and monitor for unusual CPU usage patterns related to the markdown rendering process.