CVE-2026-55482: Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update

June 23, 2026

The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.

References

github.com/advisories/GHSA-33g4-646g-qwmm
github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm
nvd.nist.gov/vuln/detail/CVE-2026-55482

Code Behaviors & Features

Detect and mitigate CVE-2026-55482 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →