CVE-2026-55643: Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using Snipe-IT before 8.6.3 with FMCS floater mode enabled are exposed when a company-scoped user can make the affected API or web requests. The issue concerns access to users whose company_id is null.
What access does an attacker need?
The attacker needs a company-scoped Snipe-IT user account operating in FMCS floater mode. They can use broad API queries or bulk web actions that do not consistently enforce isCurrentUserHasAccess.
What could an affected user do?
Affected API endpoints can expose personal data and assigned licenses for out-of-scope users. Bulk edit requests can modify profiles, while the merge function can soft-delete users and transfer their assigned assets.
How can this be remediated?
Upgrade Snipe-IT to version 8.6.3, which fixes the issue.