{"id":"CVE-2026-55482","title":"Snipe-IT is an IT asset/license management system","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing asse…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwe":["CWE-639"],"vendor":"snipeitapp","product":"snipe-it","affected":["snipe-it < 8.4.1"],"patched":["snipe-it 8.4.1"],"published":"2026-08-19","updated":"2026-09-30","sourceUpdated":"2026-09-30T12:59:15.427","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55482","references":[{"url":"https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-33g4-646g-qwmm"}],"tags":["nvd","ghsa","composer"],"epss":0.00332,"epssPercentile":0.2631,"ecosystem":"composer","ingestedAt":"2026-06-26T16:43:14.584Z","slug":"CVE-2026-55482","body":"## Overview\n\nSnipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.\n\n## Affected\n\n- `snipe-it < 8.4.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snipe-it 8.4.1`\n\n## Package advisory (CVE-2026-55482)\n\nAffected packages:\n\n- `snipe/snipe-it <= 8.4.1`\n\nPatched in:\n\n- `snipe/snipe-it 8.4.2`\n\nSource: https://github.com/advisories/GHSA-33g4-646g-qwmm","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}