Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
Impact
When Full Multiple Companies Support and scope_locations_fmcs are both enabled, the API endpoint for creating locations can still create a child location under a parent location from a different company. The code detects the invalid parent/child company mismatch, but it appears not to return immediately, so the request continues and the record is still saved. The equivalent Web flow correctly rejects the same relationship.
This breaks the expected company-boundary enforcement for location hierarchies under FMCS. It allows cross-company parent/child relationships to be inserted into the location tree, which can affect hierarchy integrity, downstream business logic, and the consistency of company isolation between the Web and API interfaces.
Patches
Patched in https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | snipe/snipe-it | < 8.6.2 | 8.6.2 |
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-8w8c-8mx9-52cw
- https://nvd.nist.gov/vuln/detail/CVE-2026-55472
- https://github.com/grokability/snipe-it/commit/9a8cbd6e00613a726b639a97a1da71b3c54f9489
- https://github.com/grokability/snipe-it
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-863- Platform
- Composer
- Package
snipe/snipe-it- Disclosed
- 28.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-8w8c-8mx9-52cw - CC BY 4.0
Vulnerability history: snipe/snipe-it
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 81
- First → latest
- 10.2021 09.2026
- Without a fix
- 6
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 23
- Medium 53
- Low 4
Disclosures per year
- 2021: 10
- 2022: 20
- 2023: 2
- 2024: 3
- 2025: 6
- 2026: 40
-
Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.