CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894 Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894

Snipe-IT , an IT asset management platform, contains an authorization bypass in its predefined kit checkout path. The root cause is that PredefinedKitCheckoutService never calls the tenant-isolation check ($item->canCheckoutTo($target)) that all other checkout paths enforce under Full Multiple...

EUVD-2026-75444

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

PT-2026-89405

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, AppServicesPredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CVE-2026-88894: Incorrect Authorization

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support FMCS tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item-canCheckoutTo$target; it...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection via the downloadLocationScopingReport process. An attacker can execute arbitrary spreadsheet formulas in the context of a privileged user's spreadsheet...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the ReportsController::sentAssetAcceptanceReminder and ReportsController::deleteAssetAcceptance endpoints when Full Multiple Company Support is...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the unacceptedassets report process. An attacker can obtain sensitive inventory details and assignee names belonging to...

Improper Cleanup on Thrown Exception

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception through the restore process. An attacker can cause permanent data loss by uploading a corrupted or invalid backup archive, resulting in...

External Control of File Name or Path

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path in the category EULA text field processing during the rendering of checkout confirmation emails. An attacker can access sensitive files...

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection in the ReportsController::postAssetAcceptanceReport process. An attacker can inject malicious formula content into free-text fields that appear in the acceptan...

Race Condition

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Race Condition through the checkout process. An attacker can cause inconsistent asset assignment records and corrupt audit trails by sending concurrent checkout requests for...

Improper Privilege Management

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Privilege Management via the Livewire component lifecycle methods. An attacker can gain unauthorized access to sensitive administrative functions and escalate...

Unchecked Return Value

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Unchecked Return Value in the store process. An attacker can cause acceptance records to be finalized without supporting evidence files by completing an acceptance while the...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the oauth/personal-access-tokens routes, which are exposed with insufficient middleware protections. An attacker can obtain a long-lived bearer...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to improper return value checking in the destroy process. An attacker can cause files to remain...

External Control of File Name or Path

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path via improper sanitization of markdown image syntax in note fields. An attacker can access sensitive server files and perform unauthoriz...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization via the assetmodel endpoint. An attacker can bypass administrative restrictions and create unauthorized checkout requests for asset models that are n...