grokability/snipe-it · Security
Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
- GHSA ID
- GHSA-33g4-646g-qwmm
- CVE ID
- CVE-2026-55482
- Severity
- medium
- Published
- Updated
- CVSS
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v3
- 6.3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Description
Impact
The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.
Patches
Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
CWEs
- CWE-639 · Authorization Bypass Through User-Controlled Key