Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-86734

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticated users to submit unbounded input that reaches synchronous CommonMark rendering. Attackers can submit large note values to exhaust PHP worker CPU and cause denial of service through resource exhaustion in the markdown parsing pipeline.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 21.9%
CVSS Severity
CVSS v3 Score 6.5
Products affected by CVE-2026-86734


Contact Us

Shodan ® - All rights reserved