GHSA-575r-357h-fhch
Suggest an improvement- Source
- https://github.com/advisories/GHSA-575r-357h-fhch
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-575r-357h-fhch/GHSA-575r-357h-fhch.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-575r-357h-fhch
- Aliases
- Published
- 2026-08-28T18:06:05Z
- Modified
- 2026-08-28T18:15:06Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
- Summary
- Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
- Details
-
Impact
The API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope.
In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or move a maintenance record onto an asset belonging to Company B. The endpoint appears to authorize access to the existing maintenance record’s asset, but does not re-authorize the newly supplied asset_id before saving the update.
Affected endpoint
PATCH /api/v1/maintenances/{maintenance_id}Also likely affected:
PUT /api/v1/maintenances/{maintenance_id}Preconditions
The attacker needs:
- A valid authenticated API token.
- Permission to update asset maintenance records.
- Access to a maintenance record currently attached to an asset in their own company.
The attacker does not need access to the target asset’s company.
Root cause
In the API maintenance update flow, the application checks access to the current maintenance record / current asset, then accepts attacker-controlled fields including
asset_id.The vulnerable behavior is that the new asset_id is not checked against the current user’s company scope before being saved.
Relevant code path:
app/Http/Controllers/Api/MaintenancesController.phpThe update method loads the maintenance, checks access to the existing $maintenance->asset, then calls:
$maintenance->fill($request->all()); $maintenance->save();Since
asset_idis fillable on the maintenance model, the attacker can re-parent the record to another company’s asset.Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Security impact
This breaks tenant/company isolation in multi-company deployments. A scoped user can write maintenance records against assets outside their authorized company boundary.
Potential impact includes:
- Cross-company asset history pollution.
- Unauthorized modification of another company’s asset maintenance timeline.
- Incorrect maintenance, cost, audit, and warranty records on victim-company assets.
- Loss of integrity in asset lifecycle records.
This is not intended functionality because the application’s company-scoping model should prevent users from writing records onto inaccessible assets.
- Database specific
{ "cwe_ids": [ "CWE-639" ], "github_reviewed": true, "github_reviewed_at": "2026-08-28T18:06:05Z", "nvd_published_at": "2026-07-10T19:17:25Z", "severity": "HIGH" }- References
-
- https://github.com/grokability/snipe-it/security/advisories/GHSA-575r-357h-fhch
- https://nvd.nist.gov/vuln/detail/CVE-2026-55516
- https://github.com/grokability/snipe-it/commit/905d498ecdb0ee5591231c97bf48435e92044368
- https://github.com/grokability/snipe-it
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2
Affected packages
Packagist / snipe/snipe-it
Package
- Name
- snipe/snipe-it
- Purl
- pkg:composer/snipe/snipe-it
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.6.2