What is GHSA-j6fh-grf4-39xr?

GHSA-j6fh-grf4-39xr is a security advisory published by GitHub Security Advisories with Medium severity. Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing...

Which CVE IDs does GHSA-j6fh-grf4-39xr cover?

GHSA-j6fh-grf4-39xr covers the following CVE IDs: CVE-2026-86768. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j6fh-grf4-39xr?

GHSA-j6fh-grf4-39xr has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-j6fh-grf4-39xrMediumCVSS 5.4

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing...

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-86768 →

📋 Description

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails.

🔗 References (4)

https://github.com/grokability/snipe-it/security/advisories/GHSA-qffp-xpqv-gqr4
https://nvd.nist.gov/vuln/detail/CVE-2026-86768
https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-improper-input-validation-via-api-checkout
https://github.com/advisories/GHSA-j6fh-grf4-39xr