Cross-company record deletion via pivot-only authorization bypass

Incorrect authorization in Grokability Snipe-IT before 8.7.0 allows remote authenticated users to delete cross-company acceptance records. ReportsController::currentUserCanAccessAcceptance() returns true for a pivot-only user with a null users.company_id, so the reminder and deletion endpoints accept sequential IDs without checking the owning company. Exploitation requires FMCS, valid credentials, a pivot-only account, and reports.view permission; deletion erases the acceptance audit trail, while reminders disclose limited item and assignment context.