Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the BulkAssetsController::update process. An attacker can gain unauthorized access to assets belonging to other companies...

PT-2026-51642

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description Snipe-IT is an IT asset and license management system. A flaw exists where the update function within app/Http/Controllers/Assets/BulkAssetsController.php accepts the company id variable directly fr...