Authorization Bypass Vulnerability in Snipe-IT by Grokability

CVE-2026-85616

What is CVE-2026-85616?

Snipe-IT versions before 8.6.2 exhibit a vulnerability that allows authenticated users with specific permissions to exploit a flaw in the checkout-acceptance report functionality. When Full Multiple Company Support is enabled, attackers can bypass authorization checks, enumerate acceptance IDs, and potentially manipulate acceptance records, including triggering reminder emails or soft-deleting acceptances linked to other companies. This flaw arises due to inadequate validation of user authenticity concerning company affiliation.

References