Description

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-04T12:17:25.270Z",
  "pubdate": "2026-09-04T12:17:25.270Z",
  "executiveSummary": "Snipe-IT versions prior to 8.6.2 are susceptible to an authorization bypass vulnerability within the checkout-acceptance reporting module.\nThe vulnerability occurs when the 'Full Multiple Company Support' feature is enabled, allowing authenticated users with 'reports.view' permissions to interact with sensitive acceptance data outside their authorized scope.\nBy manipulating sequential acceptance IDs, an attacker can perform unauthorized actions, including the soft-deletion of acceptance records or the triggering of reminder emails for assets belonging to other companies.\nThe core issue stems from an insufficient validation mechanism—specifically, a null check failure on the legacy 'users.company_id' column—which fails to enforce multi-tenancy boundaries.\nThis flaw represents a significant risk to data integrity and organizational privacy, as it permits unauthorized cross-company actions and record manipulation without elevating administrative privileges.\nExploitation requires an attacker to possess valid credentials with at least read-only reporting access, making this an escalated privilege issue rather than an unauthenticated entry point.",
  "technicalDetails": "The vulnerability resides in the backend logic governing the processing of checkout-acceptance report actions in Snipe-IT. When 'Full Multiple Company Support' is active, the application is expected to isolate records based on company association; however, the implementation of this isolation is flawed.\nThe root cause is a deficiency in the authorization check logic, specifically involving the legacy 'users.company_id' column. The system fails to correctly validate whether a requested acceptance ID belongs to the same company as the authenticated user. Due to a faulty null check, the system permits requests to proceed even when the associated company IDs do not match.\nThe attack vector involves ID enumeration. Because acceptance IDs are sequential, an authenticated attacker can iterate through integer-based identifiers to locate target records belonging to other tenants. By sending specifically crafted HTTP requests to the checkout-acceptance endpoints, the attacker can invoke functions that are restricted to authorized users.\nAttack Flow: 1. Authentication: The attacker authenticates as a user with 'reports.view' permissions. 2. Discovery: The attacker observes the structure of acceptance requests and identifies the sequential nature of IDs. 3. Exploitation: The attacker submits requests targeting arbitrary IDs. 4. Execution: Due to the bypassed authorization check, the server processes these requests as if the requester had the appropriate multi-tenancy authorization. 5. Payload Effect: Depending on the endpoint targeted, the server executes either a soft-delete operation on the database record or triggers an automated reminder email for the acceptance, effectively allowing the attacker to perform unauthorized management operations.\nThe exposure is strictly internal to authenticated sessions; however, the impact is critical in multi-tenant environments where strict data segregation is required by policy or compliance standards. Because the check is performed server-side on the application logic rather than at the database layer, the flaw is universal across deployments where Full Multiple Company Support is toggled on.\nThe vulnerability exists specifically in versions before 8.6.2. Affected components are those managing checkout-acceptance workflows. The post-exploitation impact includes the loss of record integrity via unauthorized deletion and potential social engineering risks through the triggered reminder emails."
}