Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
Priority LOW 37CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed snipe-it (grokability): 8.6.2snipe/snipe-it (Packagist): 8.6.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| grokability | snipe-it | before 8.6.2 | 8.6.2 | Patch available | CNA |
| — | snipe/snipe-it (Packagist) | before 8.6.2 | 8.6.2 | Patch available | GHSA-pwpj-p52h-q484 |
- snipe-it Vendorgrokability Affected before 8.6.2 Fixed in 8.6.2 Patch available CNA
- snipe/snipe-it (Packagist) Vendor— Affected before 8.6.2 Fixed in 8.6.2 Patch available GHSA-pwpj-p52h-q484
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* | before 8.6.2 | Vulnerable | grokability |
- cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* Versions before 8.6.2 Vulnerable ·grokability
Remediation
- Fix · CNA snipe-it (grokability) Fixed in 8.6.2
- Fix · GHSA-pwpj-p52h-q484 snipe/snipe-it (Packagist) Fixed in 8.6.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54329
- 2026-10-03 Alias added: GHSA-pwpj-p52h-q484
References
Patch 4
- https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484
- https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3
- https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
- https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268
More grokability Snipe-it vulnerabilities
- TI-2026-45238 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API CVSS 3.1HIGH 8.7
- TI-2026-59327 Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation CVSS 4.0HIGH 8.6
- TI-2026-44513 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers CVSS 3.1HIGH 8.4
- TI-2023-05072 Cross-Site Request Forgery (CSRF) in snipe/snipe-it CVSS 3.1HIGH 8.8
- TI-2026-59308 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown CVSS 4.0HIGH 8.4
- TI-2026-59298 Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA CVSS 4.0HIGH 8.4
Sources
- CVE-2026-54329 · CVE Program
- CVE-2026-54329 · NVD
- FIRST EPSS
- GHSA-pwpj-p52h-q484 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences