CVE-2026-55482

Published: Ago 19, 2026 Last Modified: Ago 19, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low

Description

AI Translation Available

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.

639

Authorization Bypass Through User-Controlled Key

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
Likelihood of Exploit: High
View CWE Details
https://github.com/grokability/snipe-it/commit/d58fda626e8f…
https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03ed…
https://github.com/grokability/snipe-it/releases/tag/v8.4.1
https://github.com/grokability/snipe-it/releases/tag/v8.4.1
https://github.com/grokability/snipe-it/security/advisories…
https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm