Description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-19T19:17:19.967Z",
  "pubdate": "2026-08-19T19:17:19.967Z",
  "executiveSummary": "A multi-tenant isolation bypass vulnerability exists in Snipe-IT prior to version 8.4.1. The flaw resides in the bulk asset update functionality handled by the application controller.\nThis vulnerability allows an authenticated attacker possessing non-superadmin privileges to manipulate parameters during bulk asset modification processes. Specifically, the system fails to adequately validate user context against the target organization boundaries during the state-change operation.\nConsequently, low-privileged users can reassign assets across disparate company boundaries, effectively violating tenant segregation principles within shared environments.\nThe risk implications include unauthorized cross-tenant data manipulation, potential exposure of sensitive IT asset metadata, and compromise of logical access controls in multi-client deployments.\nExploitation requires authenticated access to the application with standard user privileges, specifically leveraging the bulk asset modification interface to supply arbitrary organizational identifiers.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and missing authorization checks within the asset management logic. Specifically, the flaw is located in app/Http/Controllers/Assets/BulkAssetsController.php within the update() method.\nDuring normal execution in a multi-tenant environment, state-changing requests concerning company-owned resources must enforce authorization boundaries using helper functions such as Company::getIdForCurrentUser(). This ensures that users can only assign resources to companies they are authorized to manage.\nPrior to version 8.4.1, the update() method in BulkAssetsController.php processes incoming requests and permits non-superadmin users to submit the company_id parameter directly without invoking the requisite Company::getIdForCurrentUser() validation logic.\nThe attack flow proceeds as follows: 1) An authenticated user with non-superadmin privileges initiates a bulk asset update operation via the web interface or API. 2) The user crafts or intercepts the HTTP request to include an arbitrary company_id value corresponding to a separate, unauthorized tenant. 3) The BulkAssetsController.php update() method processes the payload without cross-referencing the authenticated user's assigned organizational permissions or enforcing tenant isolation constraints. 4) The database record for the targeted assets is updated, successfully moving the assets across distinct company boundaries.\nThe affected component is the bulk asset update controller logic in Snipe-IT versions prior to 8.4.1. The vulnerability requires authenticated access, though exploitation can be performed by any non-superadmin user with baseline access to the asset management features. Network exposure is standard for web-based deployments of the application."
}