Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3 Patch
- https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5 Patch
- https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268 Patch
- https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.7 · snipeitappNVD modified 2026-10-25 15:10
Affected (CPE criteria) 1
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
References 5
- https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3 Patch
- https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5 Patch
- https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268 Patch
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2 Release Notes
- https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484 Patch, Vendor Advisory