Prior to version 8.6.3, Snipe‑IT allows a company‑scoped user operating in FMCS floater mode to bypass tenant isolation and access or modify the data of users whose company_id is null. Broad API queries and bulk web actions do not consistently apply the isCurrentUserHasAccess check, so an attacker can retrieve personal details and assigned licenses via the /api/v1/users and /api/v1/users/{id}/licenses endpoints, alter out‑of‑scope profiles with /users/bulkeditsave, and soft‑delete users while transferring assigned assets using /users/merge. This flaw enables the disclosure of sensitive information and the unauthorized manipulation of user accounts and asset ownership.

Snipe‑IT (grokability:snipe‑it) versions prior to 8.6.3 are affected. The vulnerability specifically impacts the FMCS floater mode configuration and is mitigated by upgrading to any release numbered 8.6.3 or later.

The CVSS score of 7.6 indicates a high‑severity issue, and EPSS data is not available, but the problem remains publicly known and unpatched in affected installations. The likely attack vector is through authenticated API calls or web interfaces that a company‑scoped user can perform, which suggests remote exploitation without privileged credentials beyond legitimate account access. The vulnerability is not listed in the CISA KEV catalog, but its capacity to expose personal data and alter licenses makes it a critical risk for organizations relying on strict tenant isolation.