Executive brief
Snipe-IT is an open-source asset management platform used by organizations to track IT equipment and resources. When the Full Multiple Companies Support feature is enabled, authenticated users can use the API to create location hierarchies that violate company boundaries—allowing a location from one company to be assigned as a child under a parent location from a different company. This bypasses intended isolation controls and can corrupt the location tree structure across company partitions, potentially affecting reporting, access control enforcement, and system integrity.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in the Snipe-IT location API endpoint. When both Full Multiple Companies Support (FMCS) and scope_locations_fmcs are enabled, the API endpoint that creates locations performs a company boundary check to prevent cross-company parent-child relationships, but fails to return immediately after detecting a mismatch—allowing the request to proceed and the invalid record to be saved. The web interface correctly enforces the same boundary check and rejects the request. The vulnerability requires network access and low-privilege authentication (API token or user account). An attacker can exploit this to create malformed location hierarchies that span multiple companies, compromising data isolation, hierarchy integrity, and consistency between the API and web interfaces. Patched in version 8.6.2 (commit 9a8cbd6).
Affected products
- Snipe-IT Snipe-IT <= 8.6.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: Patched in version 8.6.2
- 2026-08-28: advisory