CVE-2026-55643: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55643 Overview

CVE-2026-55643 is a broken access control vulnerability [CWE-863] in Snipe-IT, an open-source IT asset and license management system. In versions prior to 8.6.3, a company-scoped user operating in Full Multiple Company Support (FMCS) floater mode can access user records whose company_id is null. Broad API queries and bulk web actions fail to consistently apply the isCurrentUserHasAccess authorization check. Affected endpoints include /api/v1/users, /api/v1/users/{id}/licenses, /users/bulkeditsave, and /users/merge. The issue is fixed in version 8.6.3.

Critical Impact
Company-scoped users can enumerate out-of-scope user profiles, view assigned licenses, modify user records via bulk edit, and soft-delete users while transferring their assigned assets.

Affected Products

Snipe-IT versions prior to 8.6.3
Deployments using Full Multiple Company Support (FMCS) with floater mode enabled
Multi-tenant Snipe-IT installations with company-scoped user accounts

Discovery Timeline

2026-08-19 - CVE-2026-55643 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55643

Vulnerability Analysis

Snipe-IT supports a multi-tenancy feature called Full Multiple Company Support (FMCS). Users can either belong to specific companies or exist without a company association (floater users). The vulnerability originates in the company-scoping logic within app/Models/Company.php, which incorrectly grants company-scoped actors visibility into all null-company users when floater mode is active.

The flaw manifests across four endpoints. The /api/v1/users endpoint returns personal data for out-of-scope users. The /api/v1/users/{id}/licenses endpoint exposes licenses assigned to those users. The /users/bulkeditsave endpoint permits modification of profiles outside the actor's company scope. The /users/merge endpoint enables soft-deletion of out-of-scope users and reassignment of their assets.

Root Cause

The root cause is a conflation of two distinct authorization concerns. Floater mode was designed to govern whether null-company users can receive assets (canReceiveFromCompany), not whether company-scoped actors can manage them. The vulnerable query added floater users to result sets via an orWhereDoesntHave('companies') clause, expanding visibility beyond the pivot-table relationship.

Attack Vector

An authenticated, company-scoped user issues standard API requests or web actions. The server-side scoping logic returns records with null company_id values alongside the actor's own company records. No exploit chaining or elevated privileges are required beyond a valid low-privilege account.

php

// Patch from app/Models/Company.php - grokability/snipe-it commit fbe05a8
            });
        }

-        // Floater: also include users with no company associations (they float). They all float down here, Georgie.).
-        if ($floater) {
-            return $query->where(function ($q) use ($companyIds) {
-                $q->whereIn('users.id', function ($sub) use ($companyIds) {
-                    $sub->select('user_id')->from('company_user')->whereIn('company_id', $companyIds);
-                })->orWhereDoesntHave('companies');
-            });
-        }
-
+        // Floater mode governs whether null-company users can *receive* items (canReceiveFromCompany),
+        // not whether company-scoped actors can *manage* them. A company-scoped actor must only
+        // ever see users who share at least one company via the pivot, regardless of floater mode.
        return $query->whereIn('users.id', function ($sub) use ($companyIds) {
            $sub->select('user_id')->from('company_user')->whereIn('company_id', $companyIds);
        });

Source: GitHub Commit fbe05a8. The patch removes the floater branch so company-scoped actors only see users sharing a pivot-table relationship.

Detection Methods for CVE-2026-55643

Indicators of Compromise

Access log entries showing company-scoped users hitting /api/v1/users or /api/v1/users/{id}/licenses and returning payloads that include user IDs outside their company scope.
Audit trail entries recording /users/bulkeditsave or /users/merge operations performed by non-admin accounts against user IDs with null company_id.
Unexpected soft-deletion events on floater users, or asset reassignments originating from company-scoped actors.

Detection Strategies

Correlate authenticated API requests to /api/v1/users endpoints with the requesting user's company_id and flag responses containing null-company records.
Review Snipe-IT audit logs for users.merge and users.bulk_edit actions initiated by accounts that lack the superuser or admin role.
Compare pre- and post-request user record counts to detect enumeration attempts by company-scoped accounts.

Monitoring Recommendations

Ingest Snipe-IT web server access logs and application audit logs into a centralized SIEM for query-based detection.
Alert on any use of /users/merge by non-superuser accounts, since this operation transfers assets and soft-deletes user records.
Track deltas in the users table where deleted_at transitions to a non-null value without a corresponding administrative action.

How to Mitigate CVE-2026-55643

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.3 or later, which contains the corrected company-scoping logic.
Audit user accounts with company_id set to null and confirm they should remain as floater accounts.
Review recent activity logs for unauthorized access, bulk edits, or merges performed by company-scoped users.

Patch Information

The vulnerability is fixed in Snipe-IT version 8.6.3. The corrective change is available in the GitHub Release v8.6.3 and detailed in the GitHub Security Advisory GHSA-c6w2-j4wq-mvwg. The fix modifies the scopeScopeCompanyables behavior in app/Models/Company.php to enforce pivot-table membership regardless of floater mode.

Workarounds

Disable FMCS floater mode until the upgrade is applied, forcing all users to have an explicit company association.
Assign every user record an appropriate company_id value so no records exist with a null company reference.
Restrict the use of /users/merge and /users/bulkeditsave to superuser accounts through role and permission review.

bash

# Upgrade Snipe-IT via git to the patched release
cd /var/www/snipe-it
php artisan down
git fetch --tags
git checkout v8.6.3
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan up