CVE WatchSep 9, 2026

CVE-2026-86769

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records

CVSS

4.3

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 9, 2026 · Last modified: Sep 9, 2026 · CWE-282

EPSS · 30d

Not enough EPSS history yet.

Technical description

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records the checkout target user's id in the created_by column instead of the authenticated caller's id. Authenticated attackers with consumables.checkout permission can perform checkouts that result in misattributed audit trail entries in the consumables_users pivot table, obscuring which operator performed the action.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-501308.8 HIG

16.6%

——5Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firstaction shell as uid 0. This issue is fixed in version 6.4.3.41d