Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-88894— Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout

Quick assessment

Affected
grokability snipe-it
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grokability Snipe-IT是Grokability公司开源的一套面向企业的IT资产与运维管理平台。 Grokability Snipe-IT 8.7.2之前版本存在授权问题漏洞，该漏洞源于PredefinedKitCheckoutService处理预定义套件签出时未强制执行Full Multiple Company Support (FMCS)租户隔离，未调用canCheckoutTo()进行公司匹配检查，可能导致具有assets.checkout权限的非超级用户通过/kits/{kit}/

CVSS 5.4 · Medium EPSS 0.26% · P17

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 2

VendorProduct Version RangeStatus
grokability snipe-it < 8.7.2 affected
8.7.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88894

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
Source: CVE Program / CVE List V5
Vulnerability Description
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Grokability Snipe-IT 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grokability Snipe-IT是Grokability公司开源的一套面向企业的IT资产与运维管理平台。 Grokability Snipe-IT 8.7.2之前版本存在授权问题漏洞，该漏洞源于PredefinedKitCheckoutService处理预定义套件签出时未强制执行Full Multiple Company Support (FMCS)租户隔离，未调用canCheckoutTo()进行公司匹配检查，可能导致具有assets.checkout权限的非超级用户通过/kits/{kit}/
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
grokability snipe-it 0 ~ 8.7.2 -

II. Public POCs for CVE-2026-88894

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88894

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88894 (2)

IV. Related Vulnerabilities

Same product: snipe-it
Same vendor: grokability
Same weakness: CWE-863