Executive brief
Snipe-IT is an open-source IT asset management system used by organizations to track hardware, software licenses, and accessories. A security flaw in the system's API allows a user belonging to one company to create records for a different company when the 'Full Multiple Companies Support' feature is enabled. This could lead to unauthorized data entry and organizational confusion in multi-tenant environments.
Technical details
A mass assignment vulnerability exists in the Snipe-IT Accessories API prior to version 8.6.2. The 'store' method in the Accessories API controller uses the 'fill()' method with all request parameters, and because the 'company_id' field was mass-assignable, it allowed users to bypass intended multi-tenant boundaries. When 'Full Multiple Companies Support' (FMCS) is enabled, a low-privileged authenticated user can provide a 'company_id' in their API request to create accessory records associated with a different company. The fix involves explicitly setting the 'company_id' using a server-side check of the current user's authorized company scope. This issue is addressed in version 8.6.2.
Affected products
- Grokability Snipe-IT < 8.6.2
Timeline
- 2026-07-10: disclosed
- 2026-07-10: advisory
- 2026-07-10: patched: Fixed in version 8.6.2
References
- https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3
- https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
- https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2
- https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484