CVE-2026-88894: Incorrect Authorization in grokability snipe-it
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
AI Analysis
Technical Summary
The vulnerability in Snipe-IT arises because the PredefinedKitCheckoutService does not enforce the canCheckoutTo($target) check, unlike other checkout paths. This omission allows users with assets.checkout permission who belong to multiple companies to assign assets from one company to a user in another company, bypassing tenant isolation controls. The flaw affects FMCS-enabled deployments and has existed since 2019. It was runtime-verified on version 8.6.3 and code-inspected on 8.7.1. The issue is resolved in version 8.7.2.
Potential Impact
An attacker who is a non-superuser but belongs to multiple companies and has the assets.checkout permission can assign assets, licenses, consumables, and accessories to users in a different company than the asset's origin. This breaks tenant isolation in FMCS setups, potentially leading to unauthorized asset assignments across company boundaries. There is no indication of privilege escalation beyond this scope or direct data disclosure.
Mitigation Recommendations
A fix is available in Snipe-IT version 8.7.2. Users should upgrade to this version or later to remediate the vulnerability. Since no official remediation level or patch links are provided beyond this, checking the vendor advisory for confirmation and further guidance is recommended.
CVE-2026-88894: Incorrect Authorization in grokability snipe-it
Description
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
CVSS v4.0
Score 5.3medium
Affected software
grokability
snipe-it
pkg:github/grokability/snipe-itRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Snipe-IT arises because the PredefinedKitCheckoutService does not enforce the canCheckoutTo($target) check, unlike other checkout paths. This omission allows users with assets.checkout permission who belong to multiple companies to assign assets from one company to a user in another company, bypassing tenant isolation controls. The flaw affects FMCS-enabled deployments and has existed since 2019. It was runtime-verified on version 8.6.3 and code-inspected on 8.7.1. The issue is resolved in version 8.7.2.
Potential Impact
An attacker who is a non-superuser but belongs to multiple companies and has the assets.checkout permission can assign assets, licenses, consumables, and accessories to users in a different company than the asset's origin. This breaks tenant isolation in FMCS setups, potentially leading to unauthorized asset assignments across company boundaries. There is no indication of privilege escalation beyond this scope or direct data disclosure.
Mitigation Recommendations
A fix is available in Snipe-IT version 8.7.2. Users should upgrade to this version or later to remediate the vulnerability. Since no official remediation level or patch links are provided beyond this, checking the vendor advisory for confirmation and further guidance is recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-10T11:28:50.297Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa2af46acd9273b49259c42
Added to database: 09/10/2026, 13:23:18 UTC
Last enriched: 09/10/2026, 13:54:28 UTC
Last updated: 09/10/2026, 19:46:16 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.