CVE-2026-55643 in Snipe-IT
Summary
by MITRE • 08/19/2026
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
Snipe-IT serves as a comprehensive IT asset and license management platform designed to track hardware, software licenses, and associated organizational data. In versions prior to 8.6.3, the application contained a critical authorization flaw within its Floater mode implementation under the FMCS (Field Management Company Structure) configuration. This vulnerability stems from an inconsistent enforcement of access control checks across different API endpoints and bulk action handlers. Specifically, while certain parts of the system correctly validate whether a user has permission to view or modify data belonging to their assigned company scope, other critical paths fail to apply this validation consistently. The core technical deficiency lies in the failure to invoke the isCurrentUserHasAccess method during broad API queries and specific bulk web actions, allowing users with limited privileges to bypass intended isolation boundaries.
The operational impact of this vulnerability is significant for organizations relying on Snipe-IT for sensitive asset tracking. A company-scoped user operating in Floater mode can access personal data and assigned licenses belonging to other entities within the system where the target records have a null company_id or are otherwise outside their authorized scope. This information disclosure occurs through endpoints such as /api/v1/users, which exposes detailed user profiles including personally identifiable information, and /api/v1/users/{id}/licenses, which reveals license assignments that should remain confidential to specific organizational units. The lack of proper scoping allows attackers with low-level access to enumerate users and gather intelligence on the organization's infrastructure and personnel structure without triggering standard security alerts.
Beyond data exfiltration, this authorization bypass enables unauthorized modification of system state through bulk operations. The /users/bulkeditsave endpoint can be exploited by an attacker to modify profiles that are strictly out-of-scope for their user role. This capability allows for the alteration of critical account attributes, potentially leading to privilege escalation or data integrity issues within the asset management database. Furthermore, the /users/merge endpoint presents a severe risk as it permits users to soft-delete other accounts and transfer assigned assets between them. An attacker could leverage this functionality to disrupt operations by removing legitimate user records or illicitly transferring valuable software licenses and hardware assignments to controlled accounts, thereby compromising both availability and asset integrity.
This vulnerability is classified under CWE-269, which addresses Improper Privilege Control, as the application fails to enforce proper authorization levels for administrative functions. It also aligns with MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials but exploits flawed access control logic to perform actions beyond their intended scope. The issue is resolved in version 8.6.3 of Snipe-IT by ensuring that the isCurrentUserHasAccess check is uniformly applied across all relevant API endpoints and bulk action handlers. Organizations running affected versions should immediately upgrade to the patched release to restore proper isolation between company scopes and prevent unauthorized access or modification of user data and assets.