~ / search / GHSA-33g4-646g-qwmm

GHSA-33g4-646g-qwmm

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-55482

Packages

EcosystemPackageAffectedFixed in
Packagist snipe/snipe-it < 8.4.2 8.4.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

References

External links from the advisory. They lead to third-party sites.