Description

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables_users pivot table, obscuring which operator performed the action.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-09T14:17:27.447Z",
  "pubdate": "2026-09-09T14:17:27.447Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are affected by an improper ownership management vulnerability within the consumables checkout API endpoint.\nThe vulnerability resides in the backend logic responsible for recording the administrative origin of a checkout transaction.\nInstead of capturing the identifier of the authenticated user performing the action, the system incorrectly writes the target user's ID into the created_by field.\nThis flaw compromises the integrity of the application's audit trail, as the system incorrectly attributes the action to the recipient rather than the operator.\nThe vulnerability requires the attacker to possess consumables.checkout permissions, effectively limiting exploitation to authenticated users within the platform.\nThe primary risk implication is the degradation of non-repudiation and accountability within the asset management system, allowing operators to perform checkout actions while obfuscating their involvement.\nNo external network exposure is strictly required beyond access to the authenticated API interface.",
  "technicalDetails": "The root cause of the vulnerability is a logic error within the API controller responsible for handling consumables checkout operations. During the database persistence phase of a checkout transaction, the application incorrectly maps the user ID associated with the asset recipient (the checkout target) to the created_by column in the consumables_users pivot table.\nIn a secure implementation, the created_by column should derive its value from the session context of the authenticated user (e.g., Auth::id() in the underlying framework). Instead, the system retrieves the target user ID from the request payload and persists it as the actor responsible for the action.\nThe attack flow begins when an authenticated user with the consumables.checkout permission initiates an API request to check out a consumable item. The request must include the necessary parameters for the checkout operation. Upon processing the request, the application backend fails to validate the assignment of the administrative user ID, leading to the misattribution in the pivot table.\nBecause the vulnerability exists in the core API endpoint logic, any checkout performed via this method results in corrupted audit metadata. This impact is significant in enterprise environments that rely on Snipe-IT for tracking administrative activity for compliance, security auditing, or inventory oversight.\nThe affected component is the consumables checkout API endpoint in Snipe-IT versions before 8.7.0. The exploit does not require specialized tools, as it can be performed via standard API requests using legitimate user permissions. There is no requirement for elevated administrative privileges beyond those associated with the checkout function, making the scope of the vulnerability potentially wide depending on the organization's user permission policies.\nPost-exploitation impact is limited to audit trail obfuscation. By misattributing the created_by entry, an attacker can mask their activity, preventing security administrators from identifying which specific account authorized a specific inventory checkout. This undermines the ability of the system to maintain a verifiable history of operations, which is critical for incident response and forensic analysis of inventory movements."
}