CVE-2026-88894: Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a userid belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Full Multiple Company Support (FMCS) are affected if they run a version before 8.7.2. The vulnerable predefined-kit checkout service lacked the tenant-isolation check since 2019, so earlier FMCS deployments are likely affected.
What access does an attacker need?
The attacker must be a non-superuser associated with at least two companies and have the assets.checkout permission. They can submit a checkout request for a predefined kit with a user_id that belongs only to another company.
What can the attacker change?
They can assign a company-A asset to a user belonging only to company B through the predefined-kit checkout path. The same cross-company assignment can affect kit licenses, consumables, and accessories.
Is this limited to the predefined-kit checkout workflow?
Yes. The described bypass is specific to POST requests to /kits/{kit}/checkout; the single, bulk, API, accessory, license, and consumable checkout paths perform the company-mismatch check.
How can teams remediate the issue?
Upgrade Snipe-IT to version 8.7.2, which fixes the missing tenant-isolation check in predefined-kit checkout. If an immediate upgrade is not possible, restrict access to predefined-kit checkout for non-superusers who belong to multiple companies and have assets.checkout permission.