GHSA-33g4-646g-qwmm
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-55482
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · snipe/snipe-it | introduced 0, fixed 8.4.2 |
Références
- https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm WEB
- https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18 WEB
- https://github.com/grokability/snipe-it PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |