Snipe‑IT is an IT asset and license management system. In versions earlier than 8.6.2, the Accessories API create endpoint mass‑assigns all request parameters—including the company_id—directly onto the Accessory model. Because company_id is mass‑assignable and Full Multiple Companies Support is enabled, a user with low‑privileged API access in one company can forge a request that creates accessory records under another company. This missing authorization check (CWE‑862) lets the attacker add or modify asset data outside their tenant, violating data integrity and potentially confidentiality. The flaw was addressed in release v8.6.2.

All Snipe‑IT installations built by grokability that are running any version earlier than 8.6.2, provided that the Full Multiple Companies Support feature is active. Users with API access in a tenant can exploit the flaw against any other tenant on the same instance.

The CVSS score of 8.5 categorises the issue as high severity. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated API request and knowledge of a target company’s identifier, making it a privilege‑escalation scenario. The potential impact for multi‑tenant operations remains significant.