Snipe-IT is an IT asset and license management application. In versions prior to 8.4.1, a non‑superadmin user can invoke the bulk asset update endpoint and provide a company_id parameter directly in the request. Because the server‑side code does not call Company::getIdForCurrentUser(), the supplied company_id is accepted without validation, allowing the attacker to move assets between company boundaries and violate the intended multi‑tenant isolation. This authorisation bypass (CWE‑639) can expose asset ownership and confidential information, and gives the attacker unrestricted control over assets belonging to other companies.

Affecting the Snipe‑IT asset and license management application developed by grokability, specifically all releases prior to 8.4.1. The vulnerability is fixed in the 8.4.1 release. Users running any earlier version are susceptible.

This flaw carries a CVSS score of 6.3, indicating moderate severity. EPSS information is not available. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an authenticated non‑superadmin user to send a crafted HTTP POST request to the /assets/bulk endpoint with an explicit company_id field. The exploit can be performed over the network wherever the Snipe‑IT frontend or API is reachable. Because the applied payload directly sets the company context, the risk of causing cross‑company data leakage exists for any user with access to multiple organizations.