GHSA-33g4-646g-qwmm
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
At a glance
- Published
- Updated
- CVE
- CVE-2026-55482
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
Affected packages
| Package | Versions |
|---|---|
| Packagist · snipe/snipe-it | introduced 0, fixed 8.4.2 |
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm WEB
- https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18 WEB
- https://github.com/grokability/snipe-it PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |