CVE-2026-85616: Snipe-IT Authorization Bypass Vulnerability

CVE-2026-85616 Overview

CVE-2026-85616 is an authorization bypass vulnerability in Snipe-IT versions before 8.6.2. The flaw affects checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users holding the reports.view permission can enumerate sequential acceptance IDs and act on records that belong to other companies. Affected actions include soft-deleting acceptance records and triggering reminder emails to users outside the attacker's company scope. The root cause is a null check on the legacy users.company_id column that fails to enforce tenant isolation. The vulnerability is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact

Authenticated low-privilege users can bypass multi-tenant isolation to modify checkout-acceptance data and send unsolicited reminder emails to users in other companies.

Affected Products

• Snipe-IT versions prior to 8.6.2
• Deployments with Full Multiple Company Support enabled
• Instances granting the reports.view permission to non-administrative users

Discovery Timeline

• 2026-09-04 - CVE-2026-85616 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85616

Vulnerability Analysis

Snipe-IT is an open-source IT asset management platform that supports multi-tenant deployments through its Full Multiple Company Support feature. This feature is intended to isolate assets, users, and reports so that operators from one company cannot view or modify records belonging to another. The checkout-acceptance report exposes actions to soft-delete acceptance records and to send reminder emails to end users who have not yet acknowledged assigned assets.

The authorization logic that gates these actions inspects the users.company_id column on the acceptance's associated user record. When that column is null, the scope check treats the acceptance as accessible rather than rejecting the request. An authenticated user with the reports.view permission can iterate sequential acceptance IDs and invoke the vulnerable endpoints to affect records outside their tenant scope.

Root Cause

The vulnerability stems from a permissive null check on the legacy users.company_id column within the checkout-acceptance report action handlers. Instead of denying access when company ownership cannot be established, the code path allows the operation to proceed. This mishandling of a nullable tenant identifier collapses the intended cross-company boundary.

Attack Vector

An authenticated attacker with the reports.view permission enumerates sequential integer acceptance IDs against the checkout-acceptance report endpoints. For each ID, the attacker issues requests that soft-delete the acceptance record or trigger a reminder email. Because acceptance IDs are predictable, discovery does not require prior knowledge of records in other companies. The result is unauthorized modification of tenant data and email-based user harassment across company boundaries.

No verified proof-of-concept code is available. See the GitHub Security Advisory and the VulnCheck Advisory for Snipe-IT for additional technical detail.

Detection Methods for CVE-2026-85616

Indicators of Compromise

• Sequential access patterns against checkout-acceptance report endpoints from a single authenticated session.
• Soft-deleted acceptance records where the acting user does not share a company with the record owner.
• Unexpected acceptance reminder emails received by users assigned to companies other than the acting user's.
• Audit log entries showing reports.view accounts performing acceptance mutations at high frequency.

Detection Strategies

• Correlate application audit logs with tenant metadata to flag actions where actor company_id differs from target record company_id.
• Baseline normal request rates for the checkout-acceptance report endpoints and alert on enumeration-style bursts.
• Query the database for acceptance records with null users.company_id values, which are the primary abuse target.

Monitoring Recommendations

• Forward Snipe-IT web server and application logs to a centralized analytics platform for cross-tenant behavior analysis.
• Track email delivery events for acceptance reminders and alert when volume deviates from historical norms.
• Monitor authentication events for accounts holding reports.view and review any bulk read or write activity.

How to Mitigate CVE-2026-85616

Immediate Actions Required

• Upgrade Snipe-IT to version 8.6.2 or later on all production and staging instances.
• Audit user accounts that hold the reports.view permission and remove it where not required.
• Review recent checkout-acceptance deletions and reminder email activity for cross-company anomalies.
• Restore any acceptance records that were soft-deleted without authorization.

Patch Information

The issue is resolved in Snipe-IT 8.6.2. The upstream fix corrects the tenant scope check so that null users.company_id values no longer bypass company isolation in checkout-acceptance report actions. Patch details are published in the GitHub Security Advisory GHSA-jqgw-vpjc-86fc.

Workarounds

• Temporarily disable Full Multiple Company Support if operationally acceptable until the upgrade is applied.
• Restrict the reports.view permission to trusted administrators only.
• Backfill the users.company_id column so that no user records contain null tenant identifiers.
• Place the Snipe-IT application behind a reverse proxy or web application firewall rule that rate-limits sequential access to checkout-acceptance report endpoints.