CVE-2026-88894

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.

• CWE-863

• https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777
• https://www.vulncheck.com/advisories/snipe-it-before-8.7.2-authorization-bypass-via-predefined-kit-checkout
• https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777

Published

Sep 10, 2026

Last Modified

Sep 10, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
• CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
• CVE-2026-88890OpenPanel through commit cd24bb8 contains an SQL injection v…8.5
• CVE-2026-88891OpenPanel fails to enforce read-only project access level on…8.3
• CVE-2026-88892OpenPanel is an analytics platform. In all versions (no patc…5
• CVE-2026-88893OpenPanel share lookup procedures fail to validate access co…7.5
• CVE-2026-88895CyberPanel before 3.0.5 fails to enforce two-factor authenti…7.2
• CVE-2026-88896EspoCRM before 10.0.4 is vulnerable to server-side request f…5.3
• CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 accepts API authenticatio…5.9
• CVE-2026-88898AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authori…6.5
• CVE-2026-88899knowns versions before 0.31.0 fail to properly validate the …9.8
• CVE-2026-8890code100x contains an authentication bypass vulnerability in …8.8