CVE-2026-84703

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...

CVE-2026-76073: Authorization Bypass Through User-Controlled Key

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55482

Snipe-IT , a Laravel-based IT asset and license management system, is affected by an authorization bypass in the BulkAssetsController::update() method. The method accepts the company_id parameter directly from user input without invoking Company::getIdForCurrentUser(), the standard company-scopin...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

GHSA-33G4-646G-QWMM Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

Impact The BulkAssetsController::update method accepts companyid directly from user input without calling Company::getIdForCurrentUser, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking...