CVE-2026-54329High· 8.5▾ TwilightSnipe-IT API Vulnerable to Cross-Tenant Accessory Injection
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.
The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.
As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.
Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
snipe/snipe-it <= 8.6.1Upgrade to a patched release:
snipe/snipe-it 8.6.2Connected by shared product, vendor, weakness, or advisory.
CVE-2022-23064High· 8.8snipe-IT vulnerable to host header injection
CVE-2026-62368High· 8.1Snipe-IT is an IT asset/license management system
CVE-2026-63493High· 8.6Snipe-IT is an IT asset/license management system
CVE-2026-55843High· 6.5Snipe-IT has an Improper Privilege Management issue
CVE-2026-55460High· 7.1Snipe-IT has an authorization bypass on bulk editing users
CVE-2026-55464Medium· 5.4Snipe-IT vulnerable to stored XSS via Markdown custom field