Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86766Snipe-IT 8.6.3 Race Condition via Consumable Checkout

Medium 6.5

In plain English

A medium-severity race condition in snipe-it from grokability. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (POST /api/v1/consumables/{consumable_id}/checkout). The requested quantity is validated against the number of remaining units before the database transaction begins, and the transaction then creates the checkout records without locking the consumable row or re-checking availability. An authenticated user with permission to check out consumables can submit concurrent checkout requests for the same consumable so that both requests pass the availability check and succeed, over-allocating stock and driving the remaining inventory negative (e.g., a consumable with 1 remaining unit ends at -1 after two concurrent 1-unit checkouts). The issue is fixed in 8.7.0, which re-fetches the parent row under lockForUpdate inside the transaction and re-validates availability.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	8.6.3 – before 8.7.0

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-x4g2-87xc-m5jm) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Snipe-IT 8.6.3 Race Condition via Consumable Checkout third-party-advisory