Grokability Snipe-IT up to 8.7.1 Predefined Kit Checkout Service App\Services\PredefinedKitCheckoutService user_id privileges management

Summaryinfo

A vulnerability was found in Grokability Snipe-IT up to 8.7.1 and classified as critical. The affected element is the function App\Services\PredefinedKitCheckoutService of the component Predefined Kit Checkout Service. Such manipulation of the argument user_id leads to privileges management. This vulnerability is documented as CVE-2026-88894. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Grokability Snipe-IT up to 8.7.1. It has been rated as critical. Affected by this issue is the function App\Services\PredefinedKitCheckoutService of the component Predefined Kit Checkout Service. The manipulation of the argument user_id with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-88894 since 09/10/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 8.7.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Grokability

Name

• Snipe-IT

Version

• 8.7.0
• 8.7.1

Website

• Product: https://github.com/grokability/snipe-it/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion