CVE-2026-86750: snipe-it before 8.7.0 Authorization Bypass via API User Create/Update
Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store() and ::update(), the user record is filled from the request and saved before the requested companyid / companyids[] values are filtered against the actor's permitted companies (Company::getIdsForCurrentUser()). On installs using Full Multiple Companies Support (FMCS), a non-superuser holding users.create (or users.edit on a target user) can submit company identifiers for companies outside their scope — including a mix of permitted and foreign ids — causing the account row to be committed to the database before authorization is checked. Where nullcompanyisfloater=1 is set, the post-hoc filter leaves an empty company pivot and the account is persisted as a "floater" with cross-company visibility, allowing creation or relocation of user accounts across tenant boundaries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.7.0 - Configuration
Set null_company_is_floater=1 to 0 so the post-hoc filter does not leave an empty company pivot and create/relocate users as "floater" accounts with cross-company visibility.
Snipe-IT (FMCS) null_company_is_floater = 0
Event History
Frequently Asked Questions
Which deployments are exposed to cross-company account creation or relocation?
The issue affects Snipe-IT versions 8.6.3 and earlier when Full Multiple Companies Support is in use. Exploitation additionally requires a non-superuser account with users.create permission, or users.edit permission on the target user.
Does the attacker need access to the REST API?
Yes. The affected paths are the REST API user create and update operations. The attacker must be an authenticated, non-superuser user with the relevant user-management permission.
What is the impact of enabling null_company_is_floater?
With null_company_is_floater=1, filtered-out foreign company assignments can leave the persisted account with an empty company pivot. This makes the account a floater with cross-company visibility, enabling cross-tenant user creation or relocation.
What should be done to remediate this issue?
Upgrade to Snipe-IT 8.7.0, which fixes the issue. Until upgrade is possible, restrict users.create and users.edit permissions for non-superusers, particularly in deployments using Full Multiple Companies Support and null_company_is_floater=1.