CVE-2026-55482

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1

Description Snipe-IT is an IT asset and license management system. A flaw exists where the update() function within app/Http/Controllers/Assets/BulkAssetsController.php accepts the company id variable directly from user input. This bypasses the Company::getIdForCurrentUser() function, which is the standard mechanism for ensuring company-scoping. Consequently, a user without superadmin privileges can move assets across company boundaries, which breaks multi-tenant isolation (a security architecture that ensures data from different customers is kept separate).

Recommendations Update to version 8.4.1.