Description

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-09T14:17:27.307Z",
  "pubdate": "2026-09-09T14:17:27.307Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 contain a critical logic flaw involving the improper validation of soft-deleted records during asset checkout operations via the API.\nThe vulnerability allows authenticated users possessing standard checkout permissions to associate active hardware, components, or consumables with target entities (users, assets, or locations) that have been previously soft-deleted.\nBy manipulating API requests to reference these trashed identifiers, attackers can bypass intended application constraints and create orphaned database entries.\nThis vulnerability compromises the integrity of the asset ledger and audit trails, potentially leading to obscured asset visibility and unauthorized inventory status shifts.\nExploitation requires a valid authenticated session with checkout privileges, though no elevated administrative access is strictly necessary, significantly lowering the barrier for internal abuse or compromised account exploitation.\nThe vulnerability does not result in arbitrary code execution but poses a severe risk to data consistency and security compliance reporting within the asset management lifecycle.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation logic within Snipe-IT API endpoints dedicated to checkout operations for hardware, components, and consumables.\nSpecifically, the backend controllers fail to perform a strict status check or a 'trashed' state verification on the target identifiers provided in the POST request body before proceeding with the database transaction.\nIn the context of Laravel-based applications, the Eloquent ORM typically utilizes soft deletes by setting a 'deleted_at' timestamp on the record rather than executing a hard SQL deletion.\nBecause the API logic does not explicitly query for 'whereNull('deleted_at')' or apply global scope filters to these specific checkout requests, the application treats soft-deleted objects as valid, active targets for asset association.\nThe attack flow proceeds as follows: An authenticated attacker identifies a valid but soft-deleted user, asset, or location ID through reconnaissance or observation of previous audit history. The attacker then constructs a malicious POST request directed at the corresponding checkout endpoint (e.g., /api/v1/hardware/checkout). The request payload explicitly references the soft-deleted entity ID as the 'assigned_to' or 'target' field.\nUpon receiving the request, the Snipe-IT API layer performs an authentication check to confirm the user has checkout privileges, successfully passes the check, and proceeds to the checkout logic. Because the validation layer is absent or defective, the application binds the active inventory item to the trashed entity in the database.\nThe payload effectively forces a state transition that the business logic was designed to prevent. Post-exploitation impact involves the creation of orphaned references in the asset ledger. These references disrupt the integrity of audit logs, as assets appear assigned to entities that no longer officially exist within the active system scope. This state complicates administrative asset reclamation, creates 'ghost' inventory visibility, and allows for the concealment of unauthorized asset movements from security auditors who rely on the integrity of the audit trails."
}