---
id: CVE-2026-54329
title: Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
summary: Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
severity: high
cvss: 8.5
cwe:
  - CWE-74
vendor: snipe
product: snipe/snipe-it
ecosystem: composer
affected:
  - snipe/snipe-it <= 8.6.1
patched:
  - snipe/snipe-it 8.6.2
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-pwpj-p52h-q484'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484
  - url: >-
      https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
  - url: 'https://github.com/advisories/GHSA-pwpj-p52h-q484'
tags:
  - ghsa
  - composer
ingestedAt: '2026-06-26T16:43:14.568Z'
epss: 0.00389
epssPercentile: 0.30224
---

## Overview

### Impact
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.

The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.

As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.

### Patches
Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5

## Affected packages

- `snipe/snipe-it <= 8.6.1`

## Remediation

Upgrade to a patched release:

- `snipe/snipe-it 8.6.2`