Snipe-IT 8.6.3 and earlier (including pre-release develop commits) have a race condition in asset checkout. The methods Api\AssetsController::checkout() and Assets\AssetCheckoutController::store() call Asset::availableForCheckout() without locking or re-checking availability before calling Asset::checkOut(). This allows two concurrent requests to both see the asset as available and both complete checkout, resulting in duplicate checkout-history rows, doubled checkout counters, and two CheckoutableCheckedOut events for a single-assignment asset. This corrupts audit trails and utilization reporting, although the asset's final assigned_to field remains singular. Exploitation requires an authenticated session with assets.checkout permission or superuser rights and precise concurrent timing. The issue is fixed in version 8.7.0.

The vulnerability causes corruption of the asset checkout audit trail and utilization/reconciliation reporting by allowing duplicate checkout records and inflated checkout counters for a single asset. The visible assignment of the asset remains correct, so the asset is not assigned to multiple users simultaneously. Exploitation requires authenticated access with high privileges and precise timing, limiting the risk. There are no known exploits in the wild. The CVSS score is low (2.1).

Upgrade to Snipe-IT version 8.7.0 or later, where this race condition is fixed. Until then, restrict assets.checkout permission to trusted users and avoid concurrent checkout attempts for the same asset. Patch status is not explicitly stated in the input data, but the fix is confirmed in version 8.7.0.