Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
Impact
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.
The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.
As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.
Patches
Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | snipe/snipe-it | < 8.6.2 | 8.6.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L- Weakness (CWE)
CWE-74- Platform
- Composer
- Package
snipe/snipe-it- Disclosed
- 23.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-pwpj-p52h-q484 - CC BY 4.0
Vulnerability history: snipe/snipe-it
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 81
- First → latest
- 10.2021 09.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 23
- Medium 53
- Low 4
Disclosures per year
- 2021: 10
- 2022: 20
- 2023: 2
- 2024: 3
- 2025: 6
- 2026: 40
-
Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.