2 matches found
EUVD-2026-62680
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...
6.3CVSS5.2AI score0.00191EPSS
SaveExploits0References3
CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...
6.3CVSS0.00191EPSS
SaveExploits0References3
20