Executive brief
Snipe-IT is an asset management platform used to track inventory and user accounts across organizations. A flaw in the REST API allows low-privilege users to create or modify user accounts and assign them to companies they don't have permission to manage. In multi-tenant deployments, attackers can create unauthorized accounts with cross-company visibility, bypassing access controls and potentially enabling lateral movement or data access across organizational boundaries.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the UsersController::store() and ::update() methods of Snipe-IT's REST API. The root cause is a time-of-check-time-of-use (TOCTOU) flaw: the controller fills and saves the user record from the request body before validating whether the requested company assignments are permitted for the current actor. On systems with Full Multiple Companies Support (FMCS) enabled, a non-superuser holding users.create or users.edit permission can submit company IDs outside their scope—including a mix of permitted and foreign IDs—which get committed to the database before authorization filtering occurs. When null_company_is_floater=1 is configured, the post-hoc filter leaves an empty company pivot, persisting the user as a "floater" with unauthorized cross-company visibility. The attack requires network access and low-privilege credentials (users.create or users.edit role). Patches are available in Snipe-IT 8.7.0 and later, which move authorization filtering before any database writes and add transactional guarantees.
Affected products
- Snipe-IT Snipe-IT <= 8.6.3
Timeline
- 2026-08-24: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 8.7.0