Vulnerabilities CVE-2026-55482

CVE-2026-55482

Medium

Open

TLP:CLEAR

Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.

Details

CVSS Score: 6.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Confidence: 90%
Published: Aug 19, 2026
Last Modified: Aug 19, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.