CVE-2026-86736: 
NixOS vulnerability analysis and mitigation

CVE-2026-86736 is an incorrect calculation vulnerability in Snipe-IT, an open-source IT asset management application, affecting all versions before 8.7.0 (up to and including 8.6.3). The flaw exists in checkout request handling, allowing authenticated users to corrupt the assets.requests_counter field through duplicate submissions or cancellations without active requests. It was published on September 8, 2026, with a patch released in version 8.7.0. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-682 (Incorrect Calculation) and stems from two related integrity failures in the checkout-request write path within Snipe-IT. First, CancelCheckoutRequestAction (and its web counterpart) unconditionally decremented assets.requests_counter regardless of whether the caller had an active CheckoutRequest, enabling repeated calls to drive the counter arbitrarily negative. Second, CreateCheckoutRequestAction::run did not check whether the caller already had an active CheckoutRequest for the same asset, allowing duplicate submissions that each wrote a new checkout_requests row and incremented the counter, while the paired cancel only decrements once. The affected components include app/Actions/CheckoutRequests/CreateCheckoutRequestAction.php, app/Actions/CheckoutRequests/CancelCheckoutRequestAction.php, app/Models/Traits/Requestable.php, and related controllers. The fix was committed in commit 1f978ed068 (GitHub Advisory).

Successful exploitation allows any authenticated user to misrepresent pending asset demand in the administrative queue by inflating or deflating the assets.requests_counter to arbitrary values. This integrity impact can cause administrators to make incorrect asset allocation decisions based on falsified demand data, potentially disrupting IT asset management workflows. There is no confidentiality or availability impact; the vulnerability is limited to data integrity within the asset request tracking system (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires low-privilege authenticated access (any user with access to checkout request endpoints) and is exploitable over the network with low attack complexity. The EPSS score is approximately 0.172%, indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

1. Authentication: Log in to a Snipe-IT instance (version ≤ 8.6.3) with any valid user account that has access to checkout request endpoints.
2. Counter inflation via duplicate requests: Send repeated POST requests to /api/v1/hardware/{asset}/request (or the web equivalent /account/request-asset/{asset}) for the same asset without canceling the previous request. Each call creates a new checkout_requests row and increments assets.requests_counter by one, inflating the counter beyond the true number of pending requests.
3. Counter deflation via spurious cancellations: Send repeated POST requests to /api/v1/hardware/{asset}/request/cancel (or /account/request-asset/{asset}/cancel) for an asset for which the attacker has no active checkout request. Each call decrements assets.requests_counter by one regardless, driving the counter negative.
4. Impact on admin queue: The corrupted counter value is reflected in the admin queue and requestable-assets index, causing administrators to see falsified pending demand figures and potentially make incorrect asset allocation decisions (GitHub Advisory).

• Network: Repeated POST requests from a single authenticated user to /api/v1/hardware/{asset}/request or /api/v1/hardware/{asset}/request/cancel for the same asset in a short time window; unusual volume of cancel requests for assets the user has not requested.
• Logs: Application logs showing multiple checkout_requests rows created for the same user and asset without intervening cancellations; API access logs with high-frequency hits to checkout request or cancel endpoints from a single user account.
• Database: assets.requests_counter values that are negative or significantly higher than the actual number of open checkout_requests rows (where canceled_at IS NULL) for a given asset; multiple checkout_requests rows with the same user_id and asset_id and no canceled_at value (GitHub Advisory).

Upgrade Snipe-IT to version 8.7.0 or later, which introduces DuplicateCheckoutRequest and NoActiveCheckoutRequest exceptions, returns HTTP 409/404 for invalid operations, and wraps row writes and counter updates in a database transaction to prevent partial failures. As interim mitigations, implement rate limiting on checkout request and cancel endpoints, restrict access to these endpoints to authorized personnel only, and enable audit logging for all request counter modifications. The fix was committed in commit 1f978ed068 and reported by researcher PizzaStev3 (Ahmed Mohammed) (GitHub Advisory).