CVE-2026-86750

Snipe-IT versions through 8.6.3 contain an incorrect authorization flaw (CWE-863) in which the REST API user endpoints (UsersController::store() and ::update()) persist a user record before verifying that the requested company_id / company_ids[] values belong to companies the acting user is authorized to manage (Company::getIdsForCurrentUser()). On installs with Full Multiple Companies Support (FMCS) enabled, a non-superuser holding users.create, or users.edit on a target user, can submit company identifiers outside their scope — including a mix of permitted and foreign IDs — and the account row is committed to the database before authorization is enforced. The attacker gains the ability to create or relocate user accounts across tenant/company boundaries; where null_company_is_floater=1 is set, the post-hoc filter leaves an empty company pivot and the account persists as a cross-company-visible "floater", an integrity-level impact consistent with the 8.3 (High) CVSS 4.0 score. All self-hosted Snipe-IT deployments at or below 8.6.3 running FMCS and delegating user management to non-superusers are affected; deployments without FMCS are not meaningfully impacted. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known, and the flaw is fixed in 8.7.0.

What to do: Upgrade to Snipe-IT 8.7.0 or later. As interim mitigation on FMCS-enabled instances, restrict users.create and users.edit to superusers or trusted administrators and consider setting null_company_is_floater to 0 to limit cross-company "floater" visibility. Audit recently created or updated user accounts for company assignments outside the actor's scope, especially rows with an empty company pivot indicating cross-tenant visibility.