PT-2026-89405

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, AppServicesPredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-86750

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

EUVD-2026-74927

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

CVE-2026-86750 snipe-it before 8.7.0 Authorization Bypass via API User Create/Update

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In Api\UsersController::store and ::update, the user record is filled from the request and saved before the requested companyid / companyids values are filter...

PT-2026-89019

Snipe-IT versions = 8.6.3 fixed in 8.7.0 do not validate company assignment authorization before persisting user records via the REST API. In ApiUsersController::store and ::update, the user record is filled from the request and saved before the requested company id / company ids values are...