CVE-2026-88894

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.2

Description When Full Multiple Company Support (FMCS) is enabled, the predefined kit checkout path fails to enforce tenant isolation on the checkout target. The PredefinedKitCheckoutService function does not call $item->canCheckoutTo($target), performing only actor-vs-item policy and availability checks. This allows a non-superuser with assets.checkout permissions who belongs to at least two companies to use the '/kits/{kit}/checkout' endpoint to assign assets, licenses, consumables, or accessories from one company to a user belonging to a different company by providing the user id of that user.

Recommendations Update to version 8.7.2.