Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Impact When Full Multiple Companies Support and scopelocationsfmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to improper enforcement of company boundary validation when creating locations, where an invalid parent-child company relationship is detected but not blocked, allowing authenticated users to create child locations under...

CVE-2026-55472 Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Support and scopelocationsfmcs are enabled, the API location creation endpoint detects an invalid parent-child company mismatch but does not return immediately, allowing creation of a child location...