Executive brief
Snipe-IT is asset and inventory management software. Versions before 8.7.0 fail to enforce company isolation on the pending asset requests endpoint when multi-company support is enabled. Authenticated users can view all pending requests from other companies, exposing requester names, asset names, locations, and check-in dates across the entire installation without special manipulation.
Technical details
The vulnerability is an incorrect authorization check (CWE-200, CWE-863) in the GET /hardware/requested endpoint. The root cause is twofold: (1) the CheckoutRequest model lacks company scope filtering, and (2) the authorize() call passes Asset::class as a string rather than a model instance, causing the authorization policy to bypass the per-record company scope check and collapse to a simple permission check (assets.view). An authenticated user with the routine assets.view permission can issue a single unmodified GET request to retrieve the entire cross-tenant list of pending asset requests. No parameter manipulation or user interaction is required. The vulnerability affects all FMCS-enabled installations running v8.6.3 or earlier; it was fixed in the develop branch on 2026-06-22 and ships in v8.7.0.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub security advisory published
- 2026-06-22: patched: Fix committed to develop branch (commit fbf441f2a2)
- 2026-09-09: advisory: NVD advisory published; CVE-2026-86767 assigned