CVE-2026-85616: Authorization Bypass Through User-Controlled Key in grokability snipe-it

CVE-2026-85616 is an authorization bypass vulnerability affecting Snipe-IT before version 8.6.2. When Full Multiple Company Support is enabled, authenticated users with the reports.view permission can exploit a null check on the legacy users.company_id column to enumerate acceptance IDs sequentially and manipulate acceptance records (soft-delete or trigger reminder emails) belonging to other companies. This flaw allows unauthorized access to data and actions across company boundaries within the application.

The vulnerability allows authenticated users with limited permissions to bypass authorization controls and access or modify acceptance records of other companies. This can lead to unauthorized data exposure and manipulation, potentially impacting data integrity and confidentiality within multi-company deployments of Snipe-IT.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or review permissions for users with reports.view access and consider disabling Full Multiple Company Support if feasible to reduce exposure.