CVE-2026-88894

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.

• CWE-863

• https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777Exploit, Patch, Vendor Advisory, Mitigation
• https://www.vulncheck.com/advisories/snipe-it-before-8.7.2-authorization-bypass-via-predefined-kit-checkoutThird Party Advisory
• https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777Exploit, Patch, Vendor Advisory, Mitigation

Published

Sep 10, 2026

Last Modified

Sep 29, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8
• CVE-2026-8889Version 3.0.7 of the Securly Chrome Extension uses deprecate…7.5
• CVE-2026-88890OpenPanel through 2.3.0 contains an SQL injection vulnerabil…8.5
• CVE-2026-88891OpenPanel through 2.3.0 fails to enforce read-only project a…8.3
• CVE-2026-88892In OpenPanel through 2.3.0, the data importer fetches a call…5
• CVE-2026-88893OpenPanel through 2.3.0 share lookup procedures fail to vali…7.5
• CVE-2026-88895CyberPanel before 3.0.5 fails to enforce two-factor authenti…7.2
• CVE-2026-88896EspoCRM before 10.0.4 is vulnerable to server-side request f…5.3
• CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 accepts API authenticatio…5.9
• CVE-2026-88898AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authori…6.5
• CVE-2026-88899knowns versions before 0.31.0 fail to properly validate the …9.8
• CVE-2026-8890code100x contains an authentication bypass vulnerability in …8.8