PT-2026-51642 · Snipe-It · Snipe-It

Published 2026-06-23 · Updated 2026-06-24 · CVE-2026-55482

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Snipe-IT (affected versions not specified)

Description An authorization bypass exists in the BulkAssetsController::update() function. The system accepts the company id variable directly from user input without utilizing the standard company-scoping function Company::getIdForCurrentUser(). This allows a non-superadmin user to move assets across company boundaries, which compromises multi-tenancy isolation (a security architecture that ensures data from different customers or companies is kept separate).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-55482

GHSA-33G4-646G-QWMM

Affected Products

Snipe-It

References · 5

• https://osv.dev/vulnerability/GHSA-33g4-646g-qwmm · Vendor Advisory
• https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18 · Note
• https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm · Note
• https://github.com/grokability/snipe-it · Note
• https://twitter.com/dailycve/status/2069579801401159889 · Twitter Post