CVE-2026-86750

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0

Description Insufficient validation of company assignment authorization occurs when persisting user records via the REST API. In the store() and update() functions of ApiUsersController, user records are saved before the company id or company ids[] variables are filtered against the actor's permitted companies via Company::getIdsForCurrentUser(). In installations using Full Multiple Companies Support (FMCS), a non-superuser with users.create or users.edit permissions can submit company identifiers outside their authorized scope. If the null company is floater=1 configuration is active, the account may be persisted as a floater with cross-company visibility, enabling the creation or relocation of user accounts across tenant boundaries.

Recommendations Update to version 8.7.0.