{"id":"CVE-2026-54329","title":"Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection","summary":"Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection","severity":"high","cvss":8.5,"cwe":["CWE-74"],"vendor":"snipe","product":"snipe/snipe-it","ecosystem":"composer","affected":["snipe/snipe-it <= 8.6.1"],"patched":["snipe/snipe-it 8.6.2"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-pwpj-p52h-q484","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484"},{"url":"https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5"},{"url":"https://github.com/advisories/GHSA-pwpj-p52h-q484"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-26T16:43:14.568Z","epss":0.00389,"epssPercentile":0.32853,"slug":"CVE-2026-54329","body":"## Overview\n\n### Impact\nA cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.\n\nThe issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.\n\nAs a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5\n\n## Affected packages\n\n- `snipe/snipe-it <= 8.6.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snipe/snipe-it 8.6.2`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":46.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}