CVE-2026-86750: Snipe-IT Authentication Bypass Vulnerability

CVE-2026-86750 Overview

CVE-2026-86750 is an authorization bypass vulnerability in Snipe-IT, the open-source IT asset management platform. Versions 8.6.3 and earlier fail to validate company assignment authorization before persisting user records through the REST API. The flaw resides in Api\UsersController::store() and ::update(), where user records are saved before company scope checks execute. On installs using Full Multiple Companies Support (FMCS), authenticated non-superusers can create or relocate accounts across tenant boundaries. The vulnerability is fixed in version 8.7.0.

Critical Impact

A non-superuser with users.create or users.edit permissions can commit user accounts to companies outside their scope, breaking multi-tenant isolation and enabling cross-company account manipulation.

Affected Products

• Snipe-IT versions <= 8.6.3
• Snipe-IT installs with Full Multiple Companies Support (FMCS) enabled
• Snipe-IT installs with null_company_is_floater=1 configured

Discovery Timeline

• 2026-09-09 - CVE-2026-86750 published to the National Vulnerability Database (NVD)
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86750

Vulnerability Analysis

The vulnerability is an incorrect authorization flaw [CWE-863] in the Snipe-IT REST API user management endpoints. When a request reaches Api\UsersController::store() or ::update(), the controller fills the user model with request data and calls save before evaluating whether the requesting actor is authorized to assign the supplied company identifiers.

The authorization filter, Company::getIdsForCurrentUser(), executes only after the account row is already committed to the database. This ordering allows attackers to influence tenant assignment before the boundary check runs.

Under Full Multiple Companies Support (FMCS), a non-superuser holding users.create or users.edit on a target can submit company_id or company_ids[] values referencing companies outside their permitted scope. Mixed payloads containing both permitted and foreign identifiers are also accepted.

Root Cause

The root cause is a persist-before-authorize sequence in the API controllers. Authorization of company assignment is enforced as a post-hoc pivot filter rather than as a request precondition. This violates the principle that authorization checks must gate all state-changing operations.

Attack Vector

An authenticated attacker with API access and either users.create or users.edit on a target user issues a POST or PATCH request containing company identifiers outside their permitted scope. The account row is committed before the filter strips unauthorized identifiers.

Where null_company_is_floater=1 is set, the post-hoc filter can leave an empty company pivot. The resulting account persists as a floater with cross-company visibility, enabling tenant boundary violations and cross-tenant account relocation.

See the GitHub Security Advisory and the VulnCheck Advisory for Snipe-IT for the underlying code path analysis.

Detection Methods for CVE-2026-86750

Indicators of Compromise

• User accounts assigned to companies that fall outside the creating actor's permitted company scope.
• User records with empty company pivot rows on installs where null_company_is_floater=1 is configured.
• API audit entries showing POST /api/v1/users or PATCH /api/v1/users/{id} calls from non-superuser tokens containing multiple company_ids[] values.

Detection Strategies

• Audit the users and users_companies (or equivalent pivot) tables for accounts whose company assignments do not match the creator's permitted scope.
• Correlate API request logs against actor permissions to identify company assignments that should have been filtered out.
• Review web server and application logs for user create or update calls immediately followed by unexpected cross-company visibility events.

Monitoring Recommendations

• Enable and centralize Snipe-IT application and API access logs for retention and analysis.
• Alert on any non-superuser API token issuing user create or update requests that reference more than one company_id.
• Baseline the volume of user create and update API calls per actor and alert on statistical deviations.

How to Mitigate CVE-2026-86750

Immediate Actions Required

• Upgrade Snipe-IT to version 8.7.0 or later, which enforces authorization before persistence in Api\UsersController::store() and ::update().
• Audit all existing user accounts created or modified via the API for company assignments outside the actor's permitted scope.
• Rotate API tokens held by non-superuser accounts with users.create or users.edit permissions until the upgrade is complete.

Patch Information

The vendor released Snipe-IT 8.7.0 to remediate CVE-2026-86750. The fix enforces Company::getIdsForCurrentUser() filtering before the user record is saved. Refer to the GitHub Security Advisory GHSA-c929-qxg6-r3mc for upgrade guidance.

Workarounds

• Restrict API access to superuser accounts until the patch is applied, removing users.create and users.edit from non-superuser roles.
• Disable Full Multiple Companies Support (FMCS) temporarily if the multi-tenant boundary is not operationally required.
• Set null_company_is_floater=0 to prevent creation of floater accounts with cross-company visibility.

# Configuration example - disable floater behavior in .env
NULL_COMPANY_IS_FLOATER=0
FULL_MULTIPLE_COMPANIES_SUPPORT=false