The vulnerability in snipe-it versions prior to 8.7.0 stems from improper handling of checkout requests, specifically in the calculation of the assets.requests_counter. Authenticated users can exploit this flaw by repeatedly calling cancellation endpoints without active requests to decrement the counter below zero or by submitting duplicate checkout requests to artificially increase the counter. This manipulation misrepresents the actual pending demand in the administrative queue, potentially impacting asset management decisions.

The impact is limited to misrepresentation of asset request counts in the admin queue. This could lead to inaccurate asset demand tracking and potential administrative confusion. There is no indication of privilege escalation, data disclosure, or system compromise. The vulnerability requires authenticated access and does not involve user interaction or complex attack vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the available data, administrators should monitor vendor communications for updates. In the meantime, restricting authenticated user permissions to trusted personnel and auditing checkout request activities may help mitigate risk.