GHSA-pwpj-p52h-q484
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pwpj-p52h-q484
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-pwpj-p52h-q484/GHSA-pwpj-p52h-q484.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pwpj-p52h-q484
- Aliases
-
- CVE-2026-54329
- Published
- 2026-06-23T23:12:04Z
- Modified
- 2026-06-23T23:15:15.489551685Z
- Severity
-
- 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L CVSS Calculator
- Summary
- Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
- Details
-
Impact
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.
The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.
As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.
Patches
Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
- Database specific
{ "github_reviewed_at": "2026-06-23T23:12:04Z", "severity": "HIGH", "cwe_ids": [ "CWE-74" ], "github_reviewed": true, "nvd_published_at": null }- References
Affected packages
Packagist / snipe/snipe-it
Package
- Name
- snipe/snipe-it
- Purl
- pkg:composer/snipe%2Fsnipe-it
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed8.6.2