CVE-2026-55482

MediumCVSS 6.3

Published: 19/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Snipe-IT prior to 8.4.1 allows a non-superadmin to submit company_id directly in the update() method of BulkAssetsController, bypassing Company::getIdForCurrentUser(). This allows assets to be moved across company boundaries, breaking multi-tenant isolation.

Risk Assessment

The risk includes breaking isolation between companies, potentially leading to unauthorized access to other organizations' assets.

Recommendation

Update to version 8.4.1 or later and enforce company assignment based on the current user.

Original NVD description (English source)

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.