CVE-2026-86747

Snipe-IT, an open source IT asset management system, contains an incorrect authorization flaw (CWE-863) in versions up to and including 8.6.3 affecting the acceptance-report endpoints POST /reports/unaccepted_assets/sent_reminder and DELETE /reports/unterminated acceptance endpoints when Full Multiple Company Support (FMCS) is enabled. The guard ReportsController::currentUserCanAccessAcceptance() in 8.6.3 early-exits and allows access for any pivot-only user (whose users.company_id is NULL), and versions before 8.6.3 had no guard at all. An authenticated attacker holding only the reports.view permission can enumerate sequential acceptance IDs and permanently delete any pending acceptance record in the installation regardless of company ownership, destroying the acceptance audit trail for that item, or trigger reminder emails that leak limited cross-company context such as item names and assignment metadata. This affects any multi-company Snipe-IT deployment with FMCS enabled that grants reports.view to non-global users, and it is fixed in version 8.7.0. No exploitation in the wild is known; the flaw is publicly documented via the vendor's GitHub security advisory, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Upgrade Snipe-IT to 8.7.0, which fixes the company scoping on both acceptance endpoints. Until patched, restrict the reports.view permission to trusted global users, and review application and mail logs for unexpected POST /reports/unaccepted_assets/sent_reminder or DELETE /reports/unterminated acceptance requests or reminder emails you did not initiate. Because deleted acceptance records are permanent, audit your unaccepted-assets reports for missing acceptance history that could indicate prior abuse.