# CVE-2026-86750: Snipe-IT authorization bypass in user REST API

Source: https://junglewise.ai/threats/cve-2026-86750-snipe-it-authorization-bypass-in-user-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86750 · Severity: high · CVSS 7.7 · Published 2026-09-09

Snipe-IT is an asset management platform used to track inventory and user accounts across organizations. A flaw in the REST API allows low-privilege users to create or modify user accounts and assign them to companies they don't have permission to manage. In multi-tenant deployments, attackers can create unauthorized accounts with cross-company visibility, bypassing access controls and potentially enabling lateral movement or data access across organizational boundaries.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86750 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86750 being exploited in the wild.

**How severe is CVE-2026-86750?** High severity, with a CVSS score of 7.7, published 9 September 2026.

**Which products and versions are affected?** Snipe-IT Snipe-IT <= 8.6.3.

**Is there a fix for CVE-2026-86750?** A patch was published on 2026-09-09: Fixed in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86750 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86750?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the UsersController::store() and ::update() methods of Snipe-IT's REST API. The root cause is a time-of-check-time-of-use (TOCTOU) flaw: the controller fills and saves the user record from the request body before validating whether the requested company assignments are permitted for the current actor. On systems with Full Multiple Companies Support (FMCS) enabled, a non-superuser holding users.create or users.edit permission can submit company IDs outside their scope—including a mix of permitted and foreign IDs—which get committed to the database before authorization filtering occurs. When null_company_is_floater=1 is configured, the post-hoc filter leaves an empty company pivot, persisting the user as a "floater" with unauthorized cross-company visibility. The attack requires network access and low-privilege credentials (users.create or users.edit role). Patches are available in Snipe-IT 8.7.0 and later, which move authorization filtering before any database writes and add transactional guarantees.

## Affected products

- Snipe-IT Snipe-IT <= 8.6.3

## Timeline

- 2026-08-24: disclosed
- 2026-09-09: advisory
- 2026-09-09: patched: Fixed in version 8.7.0

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-c929-qxg6-r3mc](https://github.com/grokability/snipe-it/security/advisories/GHSA-c929-qxg6-r3mc)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-api-user-create-update](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-api-user-create-update)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)