CVE-2026-55643 Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a company-scoped user in FMCS floater mode can access users whose companyid is null because broad API queries and bulk web actions do not consistently apply isCurrentUserHasAccess. The /api/v1/users and /api/v1/users/id/licenses...

CVE-2026-55482 Snipe-IT: Multi-Tenancy Bypass via Bulk Asset Update

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

CVE-2026-55482

Snipe-IT , a Laravel-based IT asset and license management system, is affected by an authorization bypass in the BulkAssetsController::update() method. The method accepts the company_id parameter directly from user input without invoking Company::getIdForCurrentUser(), the standard company-scopin...

CVE-2026-19539

Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content title, description, and attachments of tickets belonging to another company, to hijack another company's...