Executive brief
Snipe-IT is an asset management system used by organizations to track and maintain IT equipment across multiple departments or subsidiary companies. In multi-company deployments, this vulnerability allows an authenticated employee from one company to tamper with maintenance records of assets belonging to a different company. An attacker could corrupt maintenance histories, warranty records, and cost tracking data on victim assets, undermining audit compliance and operational integrity.
Technical details
The vulnerability exists in the API endpoint `PATCH /api/v1/maintenances/{maintenance_id}` (and likely `PUT` variant) in `app/Http/Controllers/Api/MaintenancesController.php`. The application correctly validates that the user has access to the current maintenance record's asset before allowing the update, but then uses `$maintenance->fill($request->all())` and `$maintenance->save()` without re-validating the newly supplied `asset_id` against the user's company scope. Since `asset_id` is fillable on the maintenance model, an authenticated user with maintenance-update permissions can change the asset_id to point to any asset, including those outside their authorized company boundary. The attack requires a valid API token, maintenance-update permission, and access to an existing maintenance record in the user's own company, but does not require access to the target asset. This is a classic authorization-bypass-through-user-controlled-key flaw (CWE-639) that breaks tenant isolation in multi-company environments.
Affected products
- grokability snipe-it <= 8.6.1
Timeline
- 2026-06-24: disclosed: Published on GitHub Advisory Database
- 2026-07-10: advisory: Published to NVD
- 2026-08-28: patched: Version 8.6.2 released with fix