{"id":"CVE-2026-55482","title":"Snipe-IT is an IT asset/license management system","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing asse…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-639"],"vendor":"snipe","product":"snipe/snipe-it","affected":["snipe/snipe-it <= 8.4.1"],"patched":["snipe/snipe-it 8.4.2"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:19:49.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55482","references":[{"url":"https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-33g4-646g-qwmm"}],"tags":["nvd","ghsa","composer"],"epss":0.00191,"epssPercentile":0.09089,"ecosystem":"composer","ingestedAt":"2026-06-26T16:43:14.584Z","slug":"CVE-2026-55482","body":"## Overview\n\nSnipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55482)\n\nAffected packages:\n\n- `snipe/snipe-it <= 8.4.1`\n\nPatched in:\n\n- `snipe/snipe-it 8.4.2`\n\nSource: https://github.com/advisories/GHSA-33g4-646g-qwmm","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}