CVE-2026-54329

creationtimestamp| type| source ---|---|--- 2026-07-10 19:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcwmrbo5x25 2026-07-11 17:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqf5agynjb2r...

CVE-2026-54329 Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while companyid is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another compa...