CVE-2026-86769 affects Snipe-IT versions prior to 8.7.0 and involves improper ownership management in the consumables checkout API endpoint. Specifically, when a consumable is checked out, the system incorrectly records the target user's ID in the created_by column rather than the authenticated caller's ID. This leads to audit trail entries in the consumables_users pivot table that do not accurately reflect which user performed the checkout action. The vulnerability requires authentication and the consumables.checkout permission to exploit.

The vulnerability causes misattribution in audit logs, which can obscure accountability by showing the wrong user as having performed a consumable checkout. This could hinder forensic investigations and auditing processes but does not directly allow privilege escalation or data manipulation beyond the misattribution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should carefully review audit logs and consider additional monitoring of consumables checkout activities. Restrict consumables.checkout permission to trusted users only.