CVE-2026-86750 describes an incorrect authorization vulnerability in Snipe-IT (<= 8.6.3) where the API endpoints for creating and updating users (Api\UsersController::store() and ::update()) persist user records before filtering the requested company_id or company_ids[] against the actor's permitted companies. This allows a user with users.create or users.edit permissions to assign company identifiers outside their authorized scope. When null_company_is_floater=1 is enabled, the post-authorization filter results in an empty company pivot, causing the user account to be saved as a 'floater' with cross-company visibility, enabling unauthorized cross-tenant user creation or relocation. The vulnerability is resolved in version 8.7.0.

An attacker with limited user creation or editing permissions can bypass company assignment restrictions, potentially creating or relocating user accounts across tenant boundaries. This leads to unauthorized access and visibility across multiple companies in multi-tenant environments, violating tenant isolation and data confidentiality.

A fix is available in Snipe-IT version 8.7.0. Users should upgrade to version 8.7.0 or later to resolve this authorization issue. No other vendor advisories or temporary mitigations are provided. Patch status is confirmed by the vendor stating the issue is fixed in 8.7.0.