---
id: CVE-2026-88894
title: >-
  Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company
  Support (FMCS) tenant isolation on the checkout target
summary: >-
  Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company
  Support (FMCS) tenant isolation on the checkout target. Unlike the single,
  bulk, API, accessory, license and consumable checkout paths,
  App\Services\Predefine…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-863
vendor: grokability
product: snipe-it
affected:
  - snipe-it < 8.7.2
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:18:11.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88894'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-before-8.7.2-authorization-bypass-via-predefined-kit-checkout
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-g7jx-p4xf-m777
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T15:06:02.774787Z'
ingestedAt: '2026-09-12T22:58:38.723Z'
epss: 0.0026
epssPercentile: 0.15777
---

## Overview

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check that blocks the same operation on every other checkout path. The issue is fixed in Snipe-IT 8.7.2; it was runtime-verified on v8.6.3 and code-inspected on v8.7.1, and the affected service has lacked the check since 2019, so earlier FMCS deployments are likely also affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.