CVE-2026-86752: Snipe-IT Auth Bypass Vulnerability

CVE-2026-86752 Overview

CVE-2026-86752 is an authorization bypass vulnerability in Snipe-IT, an open-source IT asset management platform. Versions before 8.7.0 fail to enforce per-instance Full Multiple Company Support (FMCS) scoping in asset audit endpoints. The application relies solely on query-layer filtering rather than policy-layer authorization checks. Authenticated users with assets.audit permissions could write audit log entries against assets belonging to other companies if the query-layer scope is bypassed or refactored. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers with valid sessions and asset audit permissions can write audit log entries against cross-company assets, undermining data segregation between tenants sharing a Snipe-IT instance.

Affected Products

Snipe-IT versions prior to 8.7.0
Multi-tenant Snipe-IT deployments using Full Multiple Company Support (FMCS)
Self-hosted and container-based Snipe-IT installations below the fixed release

Discovery Timeline

2026-09-09 - CVE-2026-86752 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86752

Vulnerability Analysis

Snipe-IT supports Full Multiple Company Support (FMCS), a feature that partitions data between companies sharing a single instance. Asset audit endpoints in versions prior to 8.7.0 enforce this partitioning at the query layer only. The controller logic filters results using scoped Eloquent queries but does not invoke a policy-layer authorization check on the target asset. An authenticated user with the assets.audit permission can therefore submit an audit action against an asset identifier owned by another company. If the query scope is bypassed, refactored, or circumvented, the audit log write proceeds without a permission gate on the target object.

Root Cause

The root cause is missing policy-layer authorization in the asset audit workflow. The application conflates data filtering with access control. Query scoping hides records from list views but does not validate that the caller is authorized to act on a specific record when the identifier is supplied directly. This maps to CWE-863: Incorrect Authorization.

Attack Vector

Exploitation requires a valid session and the assets.audit permission on the target instance. The attacker sends a crafted request to the asset audit endpoint referencing an asset ID assigned to a different company. Because the query-layer scope is the only barrier, any regression or bypass of that filter allows the write to succeed. The result is a forged audit log entry against a cross-company asset, corrupting the integrity of the audited data.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-q745-gx2m-xj93 and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-86752

Indicators of Compromise

Audit log entries written by user accounts belonging to a company that does not own the audited asset.
Unexpected POST or PATCH requests to asset audit endpoints referencing asset IDs outside the caller's company scope.
Sudden spikes in audit activity from accounts with assets.audit permissions in FMCS-enabled tenants.

Detection Strategies

Review Snipe-IT application logs for audit actions where the actor's company_id differs from the target asset's company_id.
Correlate authenticated session activity with asset ownership metadata to surface cross-company writes.
Add web application firewall rules that flag requests to audit endpoints containing asset identifiers outside the requesting user's tenant.

Monitoring Recommendations

Enable verbose audit logging on Snipe-IT and forward logs to a centralized SIEM for cross-tenant correlation.
Baseline normal audit volumes per user and alert on deviations, especially from service or integration accounts.
Monitor the Snipe-IT release channel and GitHub Security Advisories for follow-up patches or related bypass reports.

How to Mitigate CVE-2026-86752

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which introduces policy-layer authorization checks on asset audit endpoints.
Audit all accounts holding the assets.audit permission and revoke it from users who do not require it.
Review historical audit log entries for cross-company writes and validate their legitimacy with affected asset owners.

Patch Information

The vendor fixed the issue in Snipe-IT 8.7.0. Upgrade instructions and the full patch description are available in the GitHub Security Advisory GHSA-q745-gx2m-xj93 and the VulnCheck advisory.

Workarounds

If immediate upgrade is not feasible, restrict the assets.audit permission to a minimal set of trusted administrators.
Disable Full Multiple Company Support temporarily if cross-company data segregation is not strictly required.
Place the Snipe-IT application behind a reverse proxy that enforces per-tenant access rules on audit endpoints.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear
php artisan cache:clear