CVE-2026-55643 is a high severity (CVSS 8.8) incorrect authorization flaw in Snipe-IT. In multi-company mode, a company-scoped user can read, change and soft-delete users who belong to no company through API endpoints and bulk actions. Fixed in Snipe-IT 8.6.3. The steps below show how to check your version and what to change.
What's affected
- Snipe-IT before 8.6.3. Fixed in 8.6.3.
The advisory lists 8.6.2 as the affected version. The record says prior to 8.6.3. Those fit together as long as you treat 8.6.2 and earlier as affected, which is the cautious reading.
The issue applies to deployments using the multi-company feature in the mode where company-scoped users can see items without a company (the advisory calls it FMCS floater mode). Single-company installs do not use that boundary.
How to check if you're exposed
Read the version in the page footer of the Snipe-IT admin interface, or the image tag for Docker. Then check whether full multiple company support is enabled in settings, and whether you have users with no company assigned. Those users are the ones the flaw exposes.
What to do now
- Upgrade to Snipe-IT 8.6.3 or later.
- If you run the multi-company mode, list users with no company and assign them where appropriate.
- Review company-scoped accounts that have API tokens or bulk edit rights.
- Check the activity log for unexpected bulk edits, merges or deletions of users.
Why it matters
The record lists CWE-863, incorrect authorization. The advisory explains that direct checks on a single user correctly deny access, but several API endpoints and bulk web actions rely on class-level permissions or broad queries instead. Those paths did not apply the same company check, so users outside the caller's scope were reachable.
The affected actions include reading personal data and assigned licenses, editing profiles, and merging users, which can soft-delete accounts and transfer assigned assets. Consistent checks across every route to the same data is the lesson. The record does not mark this CVE as known exploited.
If you run multiple companies in one Snipe-IT instance, treat this as a reminder to test the boundary, not just trust it. After upgrading, log in as a company-scoped test user and try the user list, the user API and the bulk actions, and confirm that people with no company are not visible. Repeat the test after major upgrades, because new routes can miss the same check.
Quick check
Does this affect single-company installs?
The advisory describes company-scoped users in multi-company mode. Single-company installs do not rely on that boundary.
What data can be reached?
Personal data and assigned licenses through the API, profile edits through bulk edit, and user merge or deletion through the merge route, per the advisory.
Sources
Last reviewed: 18 October 2026.
