What is CVE-2026-86736?

CVE-2026-86736 is a medium-severity vulnerability in Grokability Snipe-It, classified under Incorrect Calculation. CVSS score: 4.3/10. Published 2026-09-08.

How severe is CVE-2026-86736?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Vulnerability in Grokability Snipe-It

CVE-2026-86736

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Weakness classification (CWE)

CWE-682 — Incorrect Calculation

References

disclosure@vulncheck.com (vendor-advisory, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-86736?: CVE-2026-86736 is a medium-severity vulnerability in Grokability Snipe-It, classified under Incorrect Calculation. CVSS score: 4.3/10. Published 2026-09-08.
How severe is CVE-2026-86736?: Medium severity. CVSS v3 base score is 4.3 out of 10.