CVE-2026-55472: Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return immediately, so the request continues and the record is still saved. The equivalent Web flow correctly rejects the same relationship.
This breaks the expected company-boundary enforcement for location hierarchies under FMCS. It allows cross-company parent/child relationships to be inserted into the location tree, which can affect hierarchy integrity, downstream business logic, and the consistency of company isolation between the Web and API interfaces.
Patches Patched in https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location under a parent location from a different company. This issue is fixed in version 8.6.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 9a8cbd6e00613a726b639a97a1da71b3c54f9489
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55472?
The severity of CVE-2026-55472 is medium with a score of 4.3.
How do I fix CVE-2026-55472?
To fix CVE-2026-55472, update Snipe-IT to version 8.6.2 or later.
What does CVE-2026-55472 affect?
CVE-2026-55472 affects the Snipe-IT software when Full Multiple Companies Support is enabled.
What vulnerability does CVE-2026-55472 describe?
CVE-2026-55472 describes an issue where the API location creation allows bypassing parent-child company boundary validation.
When was CVE-2026-55472 published?
CVE-2026-55472 was published on July 10, 2026.