Technical impact
Snipe‑IT is an IT asset and license management system. In versions prior to 8.6.2, the Accessories API create endpoint mass‑assigns request parameters—including the company_id—to the Accessory model. Because company_id is a mass‑assignable attribute and Full Multiple Companies Support is enabled, a low‑privileged authenticated user in one company can forge a request that creates accessory records under a different company. This missing authorization check (CWE‑862) lets the attacker add or modify asset data outside their tenant, violating data integrity and confidentiality. The issue is fixed in version 8.6.2.
Affected Systems
All Snipe‑IT installations built by grokability that are running any version earlier than 8.6.2, provided that the Full Multiple Companies Support feature is active. Users with API access in a tenant can exploit the flaw against any other tenant on the same instance.
Risk and Exploitability
The CVSS score of 8.5 categorises the issue as high severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated API request and knowledge of a target company’s identifier, making it a privilege‑escalation scenario. The potential impact for multi‑tenant operations remains significant.
Github GHSA