GHSA-8w8c-8mx9-52cw: Medium severity composer/snipe/snipe-it vulnerability
Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return immediately, so the request continues and the record is still saved. The equivalent Web flow correctly rejects the same relationship.
This breaks the expected company-boundary enforcement for location hierarchies under FMCS. It allows cross-company parent/child relationships to be inserted into the location tree, which can affect hierarchy integrity, downstream business logic, and the consistency of company isolation between the Web and API interfaces.
Patches Patched in https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
grokability/snipe-itto a version that resolves this vulnerability.Patch 9a8cbd6e00613a726b639a97a1da71b3c54f9489
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects deployments where both Full Multiple Companies Support and scope_locations_fmcs are enabled. It applies to location creation through the API; the equivalent Web flow rejects the invalid cross-company relationship.
What access does an attacker need?
An attacker needs low-privilege access and network access to the API. They can create a child location whose parent belongs to a different company, despite the expected company-boundary validation.
What should be done to remediate this issue?
Apply the patch containing commit 9a8cbd6e00613a726b639a97a1da71b3c54f9489. Until patched, restrict access to the API location-creation endpoint for users who do not need it, particularly in deployments with both affected company-scoping options enabled.