Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for acceptances belonging to other companies by exploiting a null check on the legacy users.company_id column.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-85616](https://github.com/grokability/snipe-it/security/advisories/GHSA-jqgw-vpjc-86fc)... https://github.com/grokability/snipe-it/security/advisories/GHSA-jqgw-vpjc-86fc #PatchManagement #Vulnerability #CVE
Post summary
The tweet links to a GitHub advisory for CVE‑2026‑85616 but offers no substantive details about the vulnerability, PoC, exploitation, or patching.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | snipeitapp | snipe-it | - | - | - |