CVE-2026-55482: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55482 Overview

Snipe-IT is an open-source IT asset and license management system used by organizations to track hardware, software, and consumables. CVE-2026-55482 is an insecure direct object reference vulnerability [CWE-639] in the BulkAssetsController::update() method that allows a non-superadmin user to submit a company_id parameter directly. The application fails to validate the submitted value through Company::getIdForCurrentUser(), breaking multi-tenant isolation. An authenticated attacker can move assets across company boundaries in a multi-tenant deployment. The issue affects Snipe-IT versions prior to 8.4.1 and is resolved in 8.4.1.

Critical Impact
Authenticated non-superadmin users can reassign assets between tenant companies, undermining data segregation in shared Snipe-IT deployments.

Affected Products

Snipe-IT versions prior to 8.4.1
app/Http/Controllers/Assets/BulkAssetsController.phpupdate() method
Multi-tenant Snipe-IT deployments using the Full Company Support feature

Discovery Timeline

2026-08-19 - CVE-2026-55482 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55482

Vulnerability Analysis

Snipe-IT supports multi-tenant isolation through its Full Company Support setting, which scopes assets, users, and other records to a specific company. The framework provides Company::getIdForCurrentUser() as the authoritative helper for resolving which company_id a non-superadmin user is permitted to act on. In the vulnerable update() method within BulkAssetsController, the controller consumes the company_id value directly from the request payload without routing it through this helper. This mismatch between trusted and untrusted input creates a broken access control condition classified under [CWE-639]. An authenticated user with permission to edit assets in one tenant company can submit a bulk update that assigns those assets to a different company. Successful exploitation compromises the confidentiality, integrity, and availability of tenant data by moving records outside the boundaries their owning company expects.

Root Cause

The root cause is missing authorization on a tenant-scoping parameter. The controller trusted the client-supplied company_id instead of deriving the authorized value from the session context through Company::getIdForCurrentUser().

Attack Vector

Exploitation is network-based and requires authenticated access with permission to perform bulk asset edits. The attacker submits a crafted request to the bulk update endpoint with an arbitrary company_id value, causing the affected assets to be reassigned to the specified tenant.

php

 use App\Http\Requests\AssetCheckoutRequest;
 use App\Models\Asset;
 use App\Models\AssetModel;
+use App\Models\Company;
 use App\Models\CustomField;
 use App\Models\Setting;
 use App\Models\Statuslabel;

Source: GitHub Commit d58fda6. The patch imports the Company model into BulkAssetsController so the controller can invoke Company::getIdForCurrentUser() and enforce tenant scoping on the incoming company_id value.

Detection Methods for CVE-2026-55482

Indicators of Compromise

Asset records whose company_id changes without a corresponding legitimate administrative action recorded in the Snipe-IT activity log.
HTTP POST or PUT requests to bulk asset update endpoints containing a company_id field submitted by non-superadmin accounts.
Sudden shifts in asset counts per company that do not align with expected transfers.

Detection Strategies

Review Snipe-IT audit and activity logs for bulk edit actions performed by non-superadmin users that modify the company assignment of assets.
Query the assets table for recent company_id changes and correlate against the acting user's role and prior tenant scope.
Inspect web server access logs for requests to the bulk assets update route where the request body includes a company_id parameter.

Monitoring Recommendations

Enable and centralize Snipe-IT application logs alongside web server logs in a SIEM for correlation.
Alert on any bulk asset modification that alters company_id values, especially when performed by accounts without superadmin privileges.
Baseline normal bulk edit patterns per tenant and flag deviations for review.

How to Mitigate CVE-2026-55482

Immediate Actions Required

Upgrade Snipe-IT to version 8.4.1 or later, which contains the fix in BulkAssetsController.
Audit historical bulk asset edits performed by non-superadmin users and revert any unauthorized company_id reassignments.
Review user roles and permissions to ensure only trusted accounts have bulk edit capability in multi-tenant deployments.

Patch Information

The fix is available in Snipe-IT release v8.4.1. The code change is documented in commit d58fda6 and described in GHSA-33g4-646g-qwmm. The patch imports the Company model and routes the incoming company_id value through Company::getIdForCurrentUser() before applying it to updated assets.

Workarounds

Restrict bulk asset edit permissions to superadmin accounts until the upgrade to 8.4.1 is applied.
Temporarily disable Full Company Support if tenant isolation cannot be assured, understanding this removes multi-tenant scoping entirely.
Place the Snipe-IT application behind a web application firewall rule that blocks requests to the bulk assets update endpoint containing a company_id field from non-superadmin sessions.

bash

# Upgrade Snipe-IT to the patched release
git fetch --tags
git checkout v8.4.1
composer install --no-dev --prefer-dist
php artisan migrate --force
php artisan config:cache