Description

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering instead of policy-layer authorization checks. Attackers with valid sessions and assets.audit permissions could write audit log entries against cross-company assets if the query-layer scope were bypassed or refactored.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-09T14:17:24.307Z",
  "pubdate": "2026-09-09T14:17:24.307Z",
  "executiveSummary": "A broken access control vulnerability exists in Snipe-IT versions prior to 8.7.0, specifically within the asset audit endpoints. The flaw stems from a reliance on query-layer filtering rather than robust policy-layer authorization checks to enforce Multi-Company Support (FMCS) scoping.\nThe vulnerability allows an authenticated attacker possessing 'assets.audit' permissions to bypass intended isolation boundaries. By successfully manipulating or bypassing the query-layer filters, an attacker can perform unauthorized write operations to audit logs for assets belonging to different companies within a multi-tenant environment.\nThis represents a significant risk to data integrity and logical separation in shared-instance deployments. Successful exploitation requires an existing, valid session with specific audit privileges, highlighting a failure to strictly enforce security policies at the backend logic level. The issue underscores the necessity of implementing authorization checks at the policy layer to ensure that users are strictly confined to their authorized tenant scope, regardless of query-layer parameters.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient authorization architecture within the Snipe-IT asset audit implementation. While the application utilizes query-layer filtering to restrict asset access based on company-based scoping in FMCS configurations, it lacks an underlying policy-layer authorization check that would explicitly validate the user's relationship with the target asset during the request execution.\nIn the vulnerable versions prior to 8.7.0, the application logic assumes that the filtering criteria applied to the data retrieval or write operation are sufficient to maintain data integrity. However, this design fails to prevent an attacker from potentially manipulating these filters or leveraging bypass techniques to target assets outside of their assigned company context. Because the authorization logic is not decoupled from the query layer, any refactoring or bypass in the query generation logic directly exposes the data layer to unauthorized write actions.\nThe exploitation flow begins with an authenticated attacker possessing valid 'assets.audit' permissions. The attacker identifies an asset audit endpoint and initiates a request. While the application typically expects the request to be constrained by the user's scope, the absence of a server-side policy check means the system does not proactively verify if the authenticated user has explicit authorization to perform an audit action on the target asset ID provided in the request.\nIf the attacker can manipulate the query parameters or exploit a subtle flaw in the query construction, they can circumvent the intended isolation. Consequently, the application processes the request, writing audit log entries into records associated with assets belonging to different companies. This leads to unauthorized data modification and potential information leakage regarding the audit trail of cross-company assets.\nThis vulnerability is localized within the asset audit processing logic. It necessitates an existing session and the specified audit privilege, but once these prerequisites are met, the attacker can act outside their authorized scope. The impact is a compromise of the logical multi-tenancy model, which is critical in environments where strict data segregation between different organizational units is required."
}