CVE-2026-54329: Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign companyid value in the API request body.
The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows companyid to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.
As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.
Patches Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while companyid is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.2Patch dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54329?
CVE-2026-54329 has a severity rating of 8.5, which is classified as high.
How do I fix CVE-2026-54329?
To fix CVE-2026-54329, update the Snipe-IT application to the latest version that addresses the cross-tenant data injection vulnerability.
What type of vulnerability is CVE-2026-54329?
CVE-2026-54329 is a cross-tenant data injection vulnerability affecting the Snipe-IT Accessories API.
Who is affected by CVE-2026-54329?
CVE-2026-54329 affects low-privileged authenticated users in a multi-company setup using Snipe-IT when Full Multiple Companies Support is enabled.
What are the potential impacts of CVE-2026-54329?
The impact of CVE-2026-54329 allows a low-privileged user to create accessory records under other companies, compromising data integrity.