Incorrect authorization in snipe-it - CVE-2026-86747
Published: August 25, 2026 / Updated: September 14, 2026
Vulnerability details
The vulnerability allows a remote user to access acceptance reminder and delete functions across company boundaries, disclose limited acceptance context, and delete pending acceptance records.
The vulnerability exists due to incorrect authorization in ReportsController::currentUserCanAccessAcceptance() when handling requests to the acceptance reminder and delete endpoints. A remote user can send a crafted request for a pending acceptance ID to access acceptance reminder and delete functions across company boundaries, disclose limited acceptance context, and delete pending acceptance records.
Exploitation requires FMCS to be enabled and the vulnerable user account to be a pivot-only user with the reports.view permission. Acceptance IDs are sequential integers, and no direct cross-company report listing access is provided by this issue.