Snipe‑IT’s predefined kit checkout workflow skips the Full Multiple Company Support (FMCS) tenant isolation check that normally blocks the assets.checkout permission who belongs to at least two companies can POST to /kits/{kit}/checkout with a user_id that belongs only to a target company different from the owner of the asset. The system performs an actor‑vs‑item policy check and an availability check, but never calls the method that verifies that the asset and target user belong to the same company. As a result, a non‑superuser can cause an asset, license, consumable or accessory to be assigned to a user inmismatch safeguard. This allows unauthorized access to another company’s assets and associated data, and may enable further theft or manipulation of those assets. The flaw involves the weak authorization check represented by CWE‑863, meaning the system fails to enforce the required precondition for the operation.

The affected product is Snipe‑IT, an asset management application developed by grokability. All installations using versions before 8.7.2 and running with Full Multiple Company Support enabled are vulnerable. Earlier releases (for example 8.6.x and 8.7.1) contain the flaw, so any FMCS deployment on those versions is at risk.

With a CVSS rating of 5.3 the vulnerability is considered moderate in impact. Because the EPSS score is unavailable, it is unclear how frequently the flaw has been exploited in the field, and the vulnerability is not currently in the CISA KEV catalog. The flaw requires the attacker to be able to authenticate to Snipe‑IT with the assets.checkout permission and run the POST request on the /kits/{kit}/checkout endpoint while FMCS is enabled. The lack of tenant isolation checks means the attacker can make a user in one company receive an asset that belongs to another company. The vulnerability’s exploitation is dependent on the presence of FMCS and on users having the appropriate permissions; the attack is possible when those conditions are met.