CVE-2026-85616

Snipe-IT versions before 8.6.2 contain an authorization bypass (CWE-639, an insecure-direct-object-reference-style flaw) in the checkout-acceptance report actions when the optional Full Multiple Company Support setting is enabled. An authenticated user holding the reports.view permission can enumerate sequential acceptance IDs and act on acceptance records belonging to other companies, because a null check on the legacy users.company_id column fails to properly scope actions to the user's own company. An attacker gains the ability to soft-delete other companies' acceptance records or trigger reminder emails for them, corrupting the integrity of asset-acceptance workflows rather than gaining code execution. Only self-hosted Snipe-IT deployments running a version before 8.6.2 with Full Multiple Company Support enabled and non-admin users granted reports.view are affected. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

What to do: Upgrade Snipe-IT to version 8.6.2 or later to fix the scoping of acceptance-report actions. As interim mitigation, restrict the reports.view permission to trusted administrators or temporarily disable Full Multiple Company Support if it is not required. Also review recent acceptance records for cross-company soft-deletions or unexpected reminder emails, since the flaw can be exploited silently by any low-privileged user with reports.view.