CVE-2026-86750: snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Published Sep 9, 2026
·
Updated

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested companyid / companyids[] values are filtered against the actor's permitted companies (Company::getIdsForCurrentUser()). On installs using Full Multiple Companies Support (FMCS), a non-superuser holding users.create (or users.edit on a target user) can submit company identifiers for companies outside their scope — including a mix of permitted and foreign ids — causing the account row to be committed to the database before authorization is checked. Where nullcompanyisfloater=1 is set, the post-hoc filter leaves an empty company pivot and the account is persisted as a "floater" with cross-company visibility, allowing creation or relocation of user accounts across tenant boundaries.

Affected Software

1 affected component
Snipe-IT Snipe-IT<=8.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.7.0
  2. Configuration

    Set null_company_is_floater=1 to 0 so the post-hoc filter does not leave an empty company pivot and create/relocate users as "floater" accounts with cross-company visibility.

    Snipe-IT (FMCS) null_company_is_floater = 0

Event History

Sep 9, 2026
CVE Published
via MITRE·01:32 PM
Data Sourced
via MITRE·01:32 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed to cross-company account creation or relocation?

The issue affects Snipe-IT versions 8.6.3 and earlier when Full Multiple Companies Support is in use. Exploitation additionally requires a non-superuser account with users.create permission, or users.edit permission on the target user.

2

Does the attacker need access to the REST API?

Yes. The affected paths are the REST API user create and update operations. The attacker must be an authenticated, non-superuser user with the relevant user-management permission.

3

What is the impact of enabling null_company_is_floater?

With null_company_is_floater=1, filtered-out foreign company assignments can leave the persisted account with an empty company pivot. This makes the account a floater with cross-company visibility, enabling cross-tenant user creation or relocation.

4

What should be done to remediate this issue?

Upgrade to Snipe-IT 8.7.0, which fixes the issue. Until upgrade is possible, restrict users.create and users.edit permissions for non-superusers, particularly in deployments using Full Multiple Companies Support and null_company_is_floater=1.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203