CVE-2026-85616EPSS p29.3%

CVE-2026-85616CVE-2026-85616

snipeitapp / snipe-it

Description

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.

Scoring

CVSS 8.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
EPSS0.38% probability of exploitation · percentile 29.3% · 2026-10-05T12:00:23Z
Last modified2026-09-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.