CVE-2026-86747 Overview
Snipe-IT is an open source IT asset management system. CVE-2026-86747 is an authorization bypass vulnerability [CWE-863] affecting Snipe-IT versions up to and including 8.6.3 when Full Multiple Company Support (FMCS) is enabled. The flaw resides in the report acceptance endpoints exposed by ReportsController, where the scoping guard fails to isolate acceptance records across companies. An authenticated user with the reports.view permission can send acceptance reminders for, and permanently delete, any pending acceptance record in the installation. The issue is fixed in version 8.7.0.
Critical Impact
Authenticated users with reports.view permission can enumerate sequential acceptance IDs and destroy cross-company audit trails or trigger reminder emails exposing item and assignment metadata.
Affected Products
- Snipe-IT versions prior to 8.6.3 (guard absent entirely)
- Snipe-IT version 8.6.3 (guard present but flawed)
- Snipe-IT installations with Full Multiple Company Support (FMCS) enabled
Discovery Timeline
- 2026-09-09 - CVE-2026-86747 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86747
Vulnerability Analysis
The vulnerability affects two report acceptance endpoints: POST /reports/unaccepted_assets/sent_reminder handled by ReportsController::sentAssetAcceptanceReminder, and DELETE /reports/unaccepted_assets/{acceptanceId}/delete handled by ReportsController::deleteAssetAcceptance. Both endpoints depend on the ReportsController::currentUserCanAccessAcceptance() guard to enforce company-based scoping under FMCS. The guard fails to correctly restrict access for pivot-only users, allowing operations against acceptance records owned by other companies. Deletion is destructive and forfeits the acceptance audit trail for the affected item. Reminder emails leak limited cross-company acceptance context, including item name and assignment metadata, to arbitrary recipients.
Root Cause
In version 8.6.3, the currentUserCanAccessAcceptance() guard early-exits with return true when ! $user->company_id evaluates as truthy. This condition holds for every pivot-only user, meaning any user associated with companies through the company_user pivot table whose scalar users.company_id column is NULL. Versions prior to 8.6.3 lacked the guard entirely. Acceptance IDs are sequential integers, enabling trivial enumeration of every pending acceptance record in the installation.
Attack Vector
An authenticated attacker with the reports.view permission and a pivot-only company association issues requests against the two vulnerable endpoints. The attacker iterates sequential acceptanceId values and either invokes the reminder endpoint to trigger cross-company disclosure emails or the delete endpoint to permanently remove acceptance records. No user interaction or elevated privilege is required beyond reports.view.
No verified exploit code is publicly available. See the GitHub Security Advisory and the VulnCheck Advisory on Authorization Bypass for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86747
Indicators of Compromise
- Unexpected DELETE requests to /reports/unaccepted_assets/{acceptanceId}/delete from user accounts that do not own the underlying checkoutable item.
- Sequential or high-volume POST requests to /reports/unaccepted_assets/sent_reminder suggesting enumeration of acceptance IDs.
- Missing or truncated acceptance audit trail entries for pending checkoutable items across multiple companies.
- Recipients reporting acceptance reminder emails for items belonging to other companies.
Detection Strategies
- Correlate application access logs against user company assignments to identify pivot-only accounts interacting with acceptance endpoints.
- Alert on any authenticated user issuing acceptance deletion requests spanning multiple company_id values within a short window.
- Baseline reminder email volume per user and flag statistical outliers indicative of enumeration.
Monitoring Recommendations
- Enable verbose application logging for ReportsController actions and forward events to a centralized log store.
- Monitor the accepted_assets and audit log tables for unexplained deletions of pending records.
- Track authentication and permission changes for accounts holding reports.view, especially those lacking a scalar users.company_id.
How to Mitigate CVE-2026-86747
Immediate Actions Required
- Upgrade Snipe-IT to version 8.7.0 or later, which contains the corrected currentUserCanAccessAcceptance() guard.
- Audit all user accounts for pivot-only associations where users.company_id is NULL and reconcile intended company scope.
- Review recent activity on the acceptance reminder and deletion endpoints for unauthorized cross-company access.
- Restore missing acceptance records from backups where destructive deletions are confirmed.
Patch Information
The vulnerability is fixed in Snipe-IT version 8.7.0. Refer to the GitHub Security Advisory GHSA-p5wx-p3vv-g6p2 for patch details and upgrade guidance.
Workarounds
- Temporarily revoke the reports.view permission from any account that does not require it, especially pivot-only users, until upgrading.
- Assign a concrete users.company_id value to accounts that must retain report access so the flawed guard does not early-exit as true.
- Restrict network access to the /reports/unaccepted_assets/* routes via reverse proxy rules while the upgrade is scheduled.
# Upgrade Snipe-IT to the patched release
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
