CVE-2026-86752 in Snipe-IT
Summary
by MITRE • 09/09/2026
snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refactored.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical failure in access control logic, specifically within the asset audit endpoints. This flaw stems from an architectural decision where security enforcement relies predominantly on query-layer filtering rather than robust policy-layer authorization checks. In secure software design, particularly for multi-instance or multi-company environments utilizing FMCS (Field Multi-Company Scoping), it is imperative that every data access request undergoes a rigorous verification process at the application logic level to ensure the requesting user has explicit permission to interact with the specific resource instance. By deferring this check primarily to database query constraints, the system creates a significant gap in security posture where logical boundaries between distinct organizational units can be circumvented if an attacker manipulates input parameters or exploits how queries are constructed and executed.
From a technical perspective, the core issue lies in the insufficient validation of resource ownership during audit operations. When a user with valid authentication credentials and assets.audit permissions initiates an action against an asset, the application checks for general permission but fails to strictly enforce that the specific asset belongs to the same company or instance as the authenticated user session. This oversight allows for horizontal privilege escalation across organizational boundaries within the multi-tenant architecture. An attacker can craft requests that bypass standard UI constraints and directly interact with API endpoints associated with assets belonging to other companies, effectively treating isolated data silos as shared resources due to the lack of server-side enforcement at the policy layer.
The operational impact of this vulnerability is severe for organizations relying on Snipe-IT for strict asset isolation and compliance auditing. Attackers can write audit log entries against cross-company assets, which not only violates data segregation policies but also compromises the integrity of audit trails. This manipulation allows malicious actors to obscure their activities or frame other users by injecting false records into logs they should not have access to modify. Furthermore, it undermines trust in the system's ability to maintain accurate financial and inventory records across different business units, potentially leading to significant compliance failures with standards that require strict data isolation such as SOC 2 Type II or ISO 27001 controls regarding logical separation of information systems.
This vulnerability aligns closely with CWE-862 Missing Authorization, where the software does not perform sufficient checks on user input before granting access to resources. Additionally, it relates to CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes, as attackers can modify audit logs for objects outside their authorized scope. In terms of offensive security frameworks, this behavior is consistent with MITRE ATT&CK technique T1078 Valid Accounts, where an attacker uses legitimate credentials to access resources they are not explicitly permitted to view or modify, and potentially T1562 Impair Defenses by modifying audit logs to hide activity.
To mitigate this risk, organizations must immediately upgrade Snipe-IT to version 8.7.0 or later, which addresses the underlying authorization logic by implementing strict policy-layer checks for all asset-related operations. Until an update is applied, administrators should review API access controls and ensure that any custom integrations do not bypass standard authentication middleware. It is also recommended to implement additional monitoring on audit log endpoints to detect anomalous write activities originating from users accessing assets outside their designated organizational scope. Regular security audits focusing on multi-tenant isolation boundaries are essential to identify similar architectural flaws in other modules of the application.