CVE-2026-86739 describes a vulnerability in Snipe-IT 8.6.3 and earlier where the return value of Storage::put() is not checked when writing signature PNG and acceptance PDF files in Account\AcceptanceController::store(). On storage backends that return false on write failure without throwing exceptions (e.g., local disk with restrictive permissions, S3 with expired credentials, or quota-exceeded storage), the application proceeds to mark acceptance as complete and dispatch notifications despite the evidence files not being stored. This results in acceptance records that lack supporting evidence, compromising compliance workflows. The vulnerability requires an authenticated user to complete acceptance while the storage backend is failing silently. It is fixed in version 8.7.0.

The impact is limited to generating acceptance records that appear complete but lack the actual evidence files, causing materially incomplete compliance artifacts for EULA acknowledgements or equipment receipt workflows. There is no direct unauthorized access or data breach. An attacker cannot force the storage backend failure state but can exploit it if the backend is already failing silently. The CVSS score is low (2.3), reflecting the limited scope and impact.

A fix is available in Snipe-IT version 8.7.0. Users should upgrade to this version or later to ensure that write failures to storage backends are properly detected and handled, preventing incomplete acceptance records. Since this is a cloud service, the vendor typically manages remediation server-side; verify with the vendor advisory for confirmation. Until patched, monitoring storage backend health and permissions may help reduce risk.