Vulnerability · Published Sep 9, 2026 · Assigned by VulnCheck

CVE-2026-86750snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

High 7.7

In plain English

A high-severity incorrect authorization in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested company_id / company_ids[] values are filtered against the actor's permitted companies (Company::getIdsForCurrentUser()). On installs using Full Multiple Companies Support (FMCS), a non-superuser holding users.create (or users.edit on a target user) can submit company identifiers for companies outside their scope — including a mix of permitted and foreign ids — causing the account row to be committed to the database before authorization is checked. Where null_company_is_floater=1 is set, the post-hoc filter leaves an empty company pivot and the account is persisted as a "floater" with cross-company visibility, allowing creation or relocation of user accounts across tenant boundaries.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	0 – before 8.7.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-c929-qxg6-r3mc) vendor-advisory
VulnCheck Advisory: snipe-it before 8.7.0 Authorization Bypass via API User Create/Update third-party-advisory