CVE-2026-54329

描述

### Impact A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body. The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation. As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow. ### Patches Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5

如何修補 CVE-2026-54329

要修補 CVE-2026-54329,請將受影響套件升級到下列已修補版本。

• —升級至 8.6.2 或更新版本

CVE-2026-54329 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-54329 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• from 0, < 8.6.2

CVSS 分數

參考連結(3)

• PATCHgithub.com/grokability/snipe-it
• WEBgithub.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5
• WEBgithub.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484