CVE-2026-88894
Awaiting Analysis Awaiting Analysis - Queue

Snipe-IT FMCS Bypass in Predefined Kit Checkout

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88894
EUVD
EUVD-2026-75444

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
grokability snipe-it From 8.6.3 (inc) to 8.7.2 (exc)
snipe-it snipe-it 8.7.2
snipe-it snipe-it From 8.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88894 is an authorization bypass flaw in Snipe-IT versions before 8.7.2. It occurs in the predefined kit checkout path where tenant isolation for Full Multiple Company Support (FMCS) is not enforced. The PredefinedKitCheckoutService fails to verify if the target user belongs to the same company as the asset being checked out, allowing cross-company asset assignment.

Detection Guidance

To detect this vulnerability, verify if your Snipe-IT instance is running a version before 8.7.2. Check the version via the web interface or by running: grep -r "version" /path/to/snipe-it/.env or check the footer of the web application. Additionally, review access logs for POST requests to /kits/{kit}/checkout with mismatched company IDs in user and asset data.

Impact Analysis

A non-superuser with assets.checkout permissions and membership in at least two companies could assign assets from one company to a user in another company via the /kits/{kit}/checkout endpoint. This bypasses company restrictions present in other checkout methods.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR and HIPAA by enabling unauthorized cross-tenant data access. It allows users to assign assets from one company to users in another company without proper authorization checks, which may lead to improper data handling or exposure of sensitive information across tenants.

Mitigation Strategies

Immediately update Snipe-IT to version 8.7.2 or later. If updating is not possible, disable the predefined kit checkout feature or restrict the assets.checkout permission to superusers only. Review recent kit checkouts for unauthorized asset transfers between companies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88894. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart