CVE-2026-86759 is a missing authorization vulnerability in the grokability Snipe-IT asset management software affecting versions prior to 8.7.0. The POST /hardware/history endpoint does not properly authorize requests, allowing any authenticated user to reassign assets arbitrarily and alter audit logs. Attackers can exploit this by submitting a CSV file that reassigns assets across different companies and injects false audit trail entries, undermining the integrity and accountability of the inventory system.

The vulnerability allows authenticated users to bypass authorization controls on a critical endpoint, enabling unauthorized reassignment of assets and modification of audit logs. This can lead to fraudulent asset management, loss of inventory integrity, and compromised accountability within organizations using affected versions of Snipe-IT.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the POST /hardware/history endpoint to trusted users only and monitor for suspicious activity related to asset reassignment and audit log modifications.