Which versions of Snipe-IT are affected by EUVD-2026-62628?

Snipe-IT asset management systems using multi-tenancy are vulnerable to unauthorized cross-tenant access when floater mode is enabled, allowing authenticated users in one tenant to view, modify,…. A patch is available.

How to fix or mitigate EUVD-2026-62628?

Within 24 hours, disable FMCS floater mode in Snipe-IT configuration to eliminate the primary attack vector and implement network-level access controls restricting API endpoint access to authorized sources only. Within 7 days, conduct forensic review of API access logs covering the past 90 days, specifically examining cross-tenant user record access patterns and bulk edit/merge operations; extract detailed audit trails for any suspicious activity involving null company_id records. Within 30 days, establish vendor monitoring for Snipe-IT security releases, validate upgrade procedures against test environments, and deploy vendor patches immediately upon availability and verification.

Snipe-IT EUVD-2026-62628

Q: What is the CVSS score of EUVD-2026-62628?

EUVD-2026-62628 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-55643 HIGH

Incorrect Authorization (CWE-863)

2026-08-19 GitHub_M

GHSA-c6w2-j4wq-mvwg

Authentication Bypass Snipe It Grokability

7.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

PR:L for required authenticated company-scoped account; AC:H because FMCS floater mode must be non-default-enabled; high C/I from cross-tenant PII read and user record modification; A:L for soft-deletion impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 19, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Aug 19, 2026 - 19:07 vuln.today

Analysis Generated

Aug 19, 2026 - 19:07 vuln.today

CVE Published

Aug 19, 2026 - 18:25 cve.org

HIGH 7.6

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose company_id is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/{id}/licenses endpoints can expose personal data and assigned licenses, /users/bulkeditsave can modify out-of-scope profiles, and /users/merge can soft-delete users and transfer assigned assets. This issue is fixed in version 8.6.3.

AnalysisAI

Incorrect authorization in Snipe-IT prior to 8.6.3 allows company-scoped authenticated users operating in FMCS floater mode to cross multi-tenancy boundaries and access, modify, or merge user records associated with no company (null company_id). Affected API endpoints expose cross-tenant personal data and license assignments while bulk edit and merge actions permit unauthorized profile modification and soft-deletion with asset transfer. No public exploit or KEV listing has been identified, but the CVSS 4.0 score of 7.6 reflects the high confidentiality and integrity impact for multi-tenant deployments with floater mode enabled.

Technical ContextAI

Snipe-IT is a PHP/Laravel-based open-source IT asset and license management platform by Grokability. The vulnerability resides in app/Models/Company.php within the scopeCompanyablesDirectly method, which enforces company-level scoping on database queries. In FMCS floater mode, users with no company association (null company_id) are intended to be able to receive items from any company - but the flawed implementation incorrectly extended this access model to allow company-scoped actors to query and act upon those null-company users. The isCurrentUserHasAccess check was not consistently applied across the /api/v1/users endpoint, /api/v1/users/{id}/licenses endpoint, /users/bulkeditsave, and /users/merge routes. The root cause is CWE-863 (Incorrect Authorization): the authorization gate existed but was bypassed under a specific operational mode. The fix removes the floater-mode branch from scopeCompanyablesDirectly entirely, anchoring the semantics: floater mode governs whether null-company users can receive items, not whether company-scoped actors may manage them. CPE cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:* covers all affected versions prior to 8.6.3.

RemediationAI

Upgrade to Snipe-IT version 8.6.3, which is confirmed by the official GitHub release tag at https://github.com/grokability/snipe-it/releases/tag/v8.6.3 and the patch commit at https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b. The fix removes the floater-mode exception from scopeCompanyablesDirectly so company-scoped actors are unconditionally restricted to users sharing a company pivot record, regardless of floater settings. As an interim workaround pending upgrade, disabling FMCS floater mode eliminates the vulnerable code path entirely; the trade-off is that null-company users will no longer be able to receive assets from company-scoped actors, which may break legitimate operational workflows. Additionally, restricting access to /api/v1/users, /users/bulkeditsave, and /users/merge to superadmin roles only via WAF or reverse-proxy ACLs reduces the blast radius but does not remediate the underlying authorization flaw and adds operational complexity.