CVE-2026-54329

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3	Patch
https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5	Patch
https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268	Patch
https://github.com/grokability/snipe-it/releases/tag/v8.6.2	Release Notes
https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Snipe-IT es un sistema de gestión de activos/licencias de TI. Antes de la versión 8.6.2, la ruta de creación de la API de Accesorios asigna masivamente parámetros de solicitud al modelo Accessory mientras que company_id es asignable masivamente, lo que permite a un usuario autenticado con bajos privilegios en una empresa crear registros de accesorios bajo otra empresa cuando el Soporte Completo para Múltiples Empresas está habilitado. Este problema está solucionado en la versión 8.6.2.

Information

Published : 2026-07-10 19:17

Updated : 2026-10-25 15:10

NVD link : CVE-2026-54329

Mitre link : CVE-2026-54329

CVE.ORG link : CVE-2026-54329

JSON object : View

Products Affected

snipeitapp

snipe-it

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-54329", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54329", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T20:46:21.168886Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "< 8.6.2"}]}]}], "published": "2026-07-10T19:17:24.440", "references": [{"url": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2."}, {"lang": "es", "value": "Snipe-IT es un sistema de gesti\u00f3n de activos/licencias de TI. Antes de la versi\u00f3n 8.6.2, la ruta de creaci\u00f3n de la API de Accesorios asigna masivamente par\u00e1metros de solicitud al modelo Accessory mientras que company_id es asignable masivamente, lo que permite a un usuario autenticado con bajos privilegios en una empresa crear registros de accesorios bajo otra empresa cuando el Soporte Completo para M\u00faltiples Empresas est\u00e1 habilitado. Este problema est\u00e1 solucionado en la versi\u00f3n 8.6.2."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C0389D5-B8C4-48C1-8E1C-6CCC59B5B631", "versionEndExcluding": "8.6.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}