Description

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full Multiple Company Support is enabled, allowing authenticated users with assets.view permission to read pending asset requests from all companies. Attackers can retrieve cross-tenant data including requested asset names, requester display names and profile links, locations, and expected check-in dates without parameter manipulation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-09T14:17:27.133Z",
  "pubdate": "2026-09-09T14:17:27.133Z",
  "executiveSummary": "Snipe-IT versions prior to 8.7.0 are susceptible to an improper authorization vulnerability when the Full Multiple Company Support feature is enabled. The vulnerability exists within the GET /hardware/requested endpoint, which fails to enforce strict multi-tenant scoping policies. As a result, authenticated users possessing the assets.view permission can access unauthorized information regarding pending asset requests across all organizational entities within the deployment.\nThis flaw enables unauthorized information disclosure, allowing attackers to perform cross-tenant reconnaissance by harvesting sensitive data associated with other company units. The impact includes the exposure of asset names, requester identities (including profile links), location data, and logistical schedules. Because this vulnerability does not require complex parameter manipulation or advanced exploit payloads, the threshold for exploitation is low for any authenticated user. The integrity and confidentiality of multi-tenant data are severely compromised, presenting significant security risks for enterprises relying on Snipe-IT for centralized IT asset management across diverse business units.",
  "technicalDetails": "The root cause of this vulnerability lies in an authorization logic failure within the backend request handling for the /hardware/requested endpoint. Specifically, when the application is configured with Full Multiple Company Support, the underlying controller fails to apply scope-based query filters that would otherwise restrict the retrieval of records to the user's assigned company or administrative jurisdiction. The endpoint lacks a secondary validation layer to verify that the requesting user's identity has the necessary ownership or oversight permissions for the requested asset data across various tenant boundaries.\nThe attack flow is straightforward: an authenticated user with the baseline assets.view permission initiates a legitimate GET request to the /hardware/requested endpoint. The application processes this request by querying the database for all pending asset requests without injecting the restrictive WHERE clauses typically associated with company-specific filtering. The resulting HTTP response contains a comprehensive payload—typically JSON-formatted—that includes cross-tenant data points, including, but not limited to, requested asset labels, requester full names, internal profile links, geographic location identifiers, and anticipated check-in dates. \nBecause the application logic defaults to a global view rather than a scoped view when the endpoint is invoked, the database response is returned in its entirety to the client, regardless of the user's actual multi-company scope. This bypasses the security intent of the Full Multiple Company Support implementation. The vulnerability is present in all Snipe-IT versions preceding 8.7.0. Exploitation does not necessitate parameter manipulation or specialized crafting of the request; standard, legitimate-looking HTTP requests are sufficient to trigger the information disclosure. Once retrieved, this data can be aggregated by a malicious actor to build a detailed mapping of organizational assets, user activity, and logistics across the entire multi-tenant environment, leading to a breakdown of tenant isolation guarantees."
}