CVE-2026-86765 describes a missing authorization enforcement in Snipe-IT prior to version 8.7.0. Specifically, when submitting assignment fields such as assigned_user, assigned_asset, or assigned_location to the PATCH /api/v1/hardware/{id} endpoint, users who have edit permissions but are explicitly denied checkout permissions can bypass the checkout process. This allows them to reassign assets and modify custody records without proper authorization.

The vulnerability allows unauthorized reassignment of assets and alteration of custody records by users who should not have checkout permissions. This can lead to inaccurate asset tracking and potential misuse or loss of assets. The CVSS 4.0 base score is 7.1, indicating a high severity impact with network attack vector, low attack complexity, no privileges required beyond edit permission, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict edit permissions carefully and monitor asset update activities to detect unauthorized changes.