CVE-2026-54329

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2

Description A cross-tenant data injection issue exists in the Accessories API when Full Multiple Companies Support is enabled. A low-privileged authenticated user can create accessory records belonging to a different company by providing a foreign company id in the API request body. This occurs because the API create path mass-assigns request parameters to the Accessory model, and the company id variable is mass assignable. Unlike the web controller, the API controller fails to enforce the authenticated user's company context, allowing a user from one company to inject persistent records into another company's inventory.

Recommendations Update to version 8.6.2.