Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck
CVE-2026-88894Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
Medium 5.4
In plain English
A medium-severity incorrect authorization in snipe-it from grokability. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| grokability | snipe-it | 0 – before 8.7.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-g7jx-p4xf-m777) vendor-advisory
- VulnCheck Advisory: Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout third-party-advisory