Quick answers
- Is CVE-2026-85616 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85616 being exploited in the wild.
- How severe is CVE-2026-85616?
- High severity, with a CVSS score of 8.5, published 4 September 2026.
- Which products and versions are affected?
- Snipe Snipe-IT before 8.6.2.
- Is there a fix for CVE-2026-85616?
- A patch was published on 2026-06-12: Fix committed; shipped in v8.6.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-85616 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-85616?
- Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass (CWE-639) caused by an incorrect check on a legacy database column. When Full Multiple Company Support is enabled, normal users have users.company_id set to NULL and store their company membership in a pivot table instead. The vulnerable endpoints DELETE /reports/unaccepted_assets/{id}/delete and POST /reports/unaccepted_assets/sent_reminder fail to check this pivot table; instead, they check the NULL scalar column and treat it as "no scoping required," granting cross-company access. Any authenticated user with the reports.view permission can enumerate sequential acceptance IDs and exploit this to soft-delete acceptances or trigger reminder emails for other companies. The vulnerability was fixed in commit 802067f on 2026-06-12 and shipped in version 8.6.2.
Affected products
- Snipe Snipe-IT before 8.6.2
Timeline
- 2026-09-04: disclosed
- 2026-06-12: patched: Fix committed; shipped in v8.6.2