Snipe-IT, an IT asset and license management system, has an incorrect authorization vulnerability (CWE-863) identified as CVE-2026-55643. Before version 8.6.3, users scoped to a company in FMCS floater mode could access users with null company_id because broad API queries and bulk web actions did not consistently enforce the isCurrentUserHasAccess check. Specifically, the /api/v1/users and /api/v1/users/{id}/licenses endpoints could expose personal data and assigned licenses; the /users/bulkeditsave endpoint could modify profiles outside the user's scope; and the /users/merge endpoint could soft-delete users and transfer assigned assets improperly. This vulnerability allows unauthorized data exposure and modification. The problem is resolved in version 8.6.3.

An attacker with company-scoped user privileges in FMCS floater mode can access and manipulate user data beyond their authorized company boundaries. This includes exposure of personal user data and assigned licenses, unauthorized modification of user profiles, and the ability to soft-delete users and reassign assets. This could lead to data leakage and unauthorized asset management actions within the affected Snipe-IT deployments.

Upgrade Snipe-IT to version 8.6.3 or later, where this authorization issue is fixed. No other mitigation or workaround is documented. Patch status is not explicitly stated in the input data but the description confirms the issue is fixed in 8.6.3.