CVE-2026-85616

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2

Description An authorization bypass occurs in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs to soft-delete or trigger reminder emails for acceptances belonging to other companies. This is possible by exploiting a null check on the legacy users.company id column.

Recommendations Update to version 8.6.2 or later.