CVE-2026-55472: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55472 Overview

CVE-2026-55472 is an authorization flaw in Snipe-IT, an open-source IT asset and license management system. When Full Multiple Companies Support (FMCS) and scope_locations_fmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but fails to halt execution. Authenticated users can create a child location under a parent location that belongs to a different company, bypassing multi-tenant isolation controls. The issue is fixed in Snipe-IT version 8.6.2 and is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users can violate FMCS company boundaries via the API, undermining tenant isolation between companies sharing a Snipe-IT instance.

Affected Products

Snipe-IT versions prior to 8.6.2
Deployments with Full Multiple Companies Support (FMCS) enabled
Deployments with the scope_locations_fmcs setting enabled

Discovery Timeline

2026-07-10 - CVE-2026-55472 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55472

Vulnerability Analysis

Snipe-IT's FMCS feature enforces logical separation between companies sharing a single instance. The scope_locations_fmcs setting extends this boundary to location hierarchies, ensuring child locations remain under parents owned by the same company. In vulnerable versions, the API LocationsController performs the parent-child company check but does not return early after emitting the error response. Execution continues, and the location is persisted with a cross-company parent reference. An authenticated API user assigned to one company can attach a new location to a parent belonging to another company, defeating the tenant isolation guarantee.

Root Cause

The defect is a missing return statement in app/Http/Controllers/Api/LocationsController.php. The controller constructs an error JSON payload when it detects that $location->parent_id resolves to a Location whose company_id differs from the new location's company_id, but it never returns that response. Control flow falls through to the persistence logic. The web (non-API) controller in app/Http/Controllers/LocationsController.php was missing the parent-child check entirely.

Attack Vector

Exploitation requires an authenticated API session with permission to create locations. The attacker issues an authenticated POST to the locations API with a parent_id pointing at a location owned by a different company. Because the request is network-reachable and requires only low-privilege credentials with no user interaction, it can be scripted against any exposed Snipe-IT instance where FMCS is in use.

php

// Patch: app/Http/Controllers/Api/LocationsController.php
$location->company_id = Company::getIdForCurrentUser($request->input('company_id'));
// check if parent is set and has a different company
if ($location->parent_id && Location::find($location->parent_id)->company_id != $location->company_id) {
-    response()->json(Helper::formatStandardApiResponse('error', null, 'different company than parent'));
+    return response()->json(Helper::formatStandardApiResponse('error', null, 'different company than parent'));
}

Source: grokability/snipe-it commit 9a8cbd6

php

// Patch: app/Http/Controllers/LocationsController.php (web controller)
if (Helper::test_locations_fmcs(false, $location->id, $location->company_id)) {
    return redirect()->back()->withInput()->withInput()->with('error', 'error scoped locations');
}
+// check if parent is set and has a different company
+if ($location->parent_id && Location::find($location->parent_id)->company_id != $location->company_id) {
+    return redirect()->back()->withInput()->withInput()->with('error', 'different company than parent');
+}

Source: grokability/snipe-it commit 9a8cbd6

Detection Methods for CVE-2026-55472

Indicators of Compromise

Location records in the locations table where parent_id references a location whose company_id differs from the child's company_id.
API access logs showing successful POST /api/v1/locations requests that include a parent_id outside the authenticated user's company scope.
Audit log entries for location creation immediately preceded by an application error referencing different company than parent.

Detection Strategies

Run a SQL audit joining locations to itself on parent_id and flag rows where the parent and child company_id values do not match.
Correlate web server logs with application logs to identify create-location API calls that were logged as errors yet still resulted in database inserts.
Review Snipe-IT activity logs for location creations performed by low-privileged users targeting parents in other companies.

Monitoring Recommendations

Alert on any location create or update API activity from accounts that historically operate within a single company scope.
Baseline the volume of /api/v1/locations POST requests per user and flag deviations.
Forward Snipe-IT application and web server logs to a centralized log platform for retention and query.

How to Mitigate CVE-2026-55472

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.2 or later, which contains the fix in commit 9a8cbd6.
Audit existing location records for cross-company parent-child relationships and remediate any that violate FMCS boundaries.
Rotate API tokens for accounts that had location-creation privileges during the exposure window.

Patch Information

The fix is available in Snipe-IT v8.6.2. Details are published in GitHub Security Advisory GHSA-8w8c-8mx9-52cw. The patch adds an explicit return to the API controller and introduces the parent-child company check in the web controller.

Workarounds

If patching is not immediately possible, disable scope_locations_fmcs only if the resulting tenant behavior is acceptable, or restrict API token issuance to trusted administrators.
Limit network exposure of the Snipe-IT API to trusted management networks using a reverse proxy or firewall ACL.
Reduce location-management permissions for standard users until the upgrade is applied.

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
php artisan down
git fetch --tags
git checkout v8.6.2
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear && php artisan cache:clear
php artisan up