CVE-2026-86766 describes a race condition (time-of-check to time-of-use) vulnerability in Snipe-IT versions up to and including 8.6.3. The flaw exists in the POST /api/v1/consumables/{consumable_id}/checkout endpoint where the requested quantity is validated against available stock before the database transaction begins. However, the transaction that creates the checkout records does not lock the consumable row or re-check availability, allowing multiple concurrent requests to pass the availability check and succeed. This leads to over-allocation of consumables and negative inventory counts. The vulnerability requires authenticated users with permission to check out consumables. The issue is resolved in version 8.7.0 by re-fetching the consumable row with a lockForUpdate inside the transaction and re-validating availability.

An authenticated user with checkout permissions can exploit this race condition to over-allocate consumable stock, causing inventory counts to become inaccurate and negative. This can disrupt inventory management and potentially lead to resource shortages or accounting errors. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 score is 7.1 (high severity) reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity.

A fix is available in Snipe-IT version 8.7.0, which addresses the race condition by implementing row locking and re-validation of consumable availability within the database transaction. Users should upgrade to version 8.7.0 or later to remediate this vulnerability. No other mitigations are indicated.