CVE-2026-86747

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description When Full Multiple Company Support (FMCS) is enabled, certain report acceptance endpoints are not correctly scoped. An authenticated user with the reports.view permission can send acceptance-reminder emails or permanently delete any pending acceptance record across the entire installation, regardless of company ownership. This occurs because the currentUserCanAccessAcceptance() function in the ReportsController incorrectly allows access for pivot-only users (users associated with companies via a pivot table whose company id is NULL), and versions prior to 8.6.3 lack this guard entirely. The affected endpoints are POST /reports/unaccepted assets/sent reminder (via sentAssetAcceptanceReminder()) and DELETE /reports/unaccepted assets/{acceptanceId}/delete (via deleteAssetAcceptance()). Deletion is destructive and removes the acceptance audit trail, while the reminder email may expose item names and assignment metadata across companies. Acceptance IDs are sequential integers and can be enumerated.

Recommendations Update to version 8.7.0. As a temporary workaround, restrict access to the POST /reports/unaccepted assets/sent reminder and DELETE /reports/unaccepted assets/{acceptanceId}/delete endpoints for users with the reports.view permission until the update is applied.