Sign in
Deutsch English Español Polski
High

Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode

  • Disclosed: 19.08.2026
  • Updated: 11.10.2026 10:22

Impact

Due to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company (company_id = null). While direct instance authorization (isCurrentUserHasAccess) correctly denies access to these out-of-scope users, multiple API endpoints and bulk action web routes fail to enforce this restriction, relying instead on class-level permissions or broad scoped queries. Impact:

A malicious user scoped to a specific company (e.g., Company A) can:

Data Leakage: Extract PII and assigned licenses of users outside their tenant via the API (/api/v1/users and /api/v1/users/{id}/licenses).

Data Modification: Mutate out-of-scope user profiles (e.g., changing city, notes) via the /users/bulkeditsave web route.

Data Deletion & Asset Theft: Soft-delete out-of-scope users and transfer their assigned assets to themselves via the /users/merge web route.

Patches

Patched in https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b,

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package snipe/snipe-it < 8.6.3 8.6.3

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-863
Platform
Composer
Package
snipe/snipe-it
Disclosed
19.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-c6w2-j4wq-mvwg - CC BY 4.0

Vulnerability history: snipe/snipe-it

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (81) in the archive
Total entries
81
First → latest
10.2021 09.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 23
  • Medium 53
  • Low 4

Disclosures per year

Severity:
  1. Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
    High · 8.7 CVE-2026-63498 < 8.7.0 8.7.0
  2. Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
    High · 8.1 CVE-2026-62368 < 8.7.0 8.7.0
  3. Snipe-IT: 2FA bypass via the API token flow
    High CVE-2026-63493 < 8.7.0 8.7.0
  4. Snipe-IT has an Improper Privilege Management issue
    High · 6.5 CVE-2026-55843 < 8.6.0 8.6.0
  5. Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
    High · 7.7 CVE-2026-55516 < 8.6.2 8.6.2
  6. Snipe-IT vulnerable to directory traversal in displaySig
    High CVE-2026-55474 < 8.5.0 8.5.0
  7. Snipe-IT has an authorization bypass on bulk editing users
    High · 7.1 CVE-2026-55460 < 8.6.2 8.6.2
  8. Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
    High CVE-2026-55694 < 8.6.3 8.6.3
  9. Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode this entry
    High CVE-2026-55643 < 8.6.3 8.6.3
  10. Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
    High · 8.5 CVE-2026-54329 < 8.6.2 8.6.2
  11. Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
    High · 7.1 CVE-2026-48507 < 8.6.0 8.6.0
  12. Snipe-IT has insecure permissions in file uploads
    Critical · 9.8 CVE-2026-37709 < 8.4.1 8.4.1
  13. Snipe-IT has Privilege Escalation via API Permissions Assignment
    High · 8.8 CVE-2026-44832 < 8.4.1 8.4.1
  14. Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
    High · 8.8 CVE-2025-15602 < 8.3.7 8.3.7
  15. Cross Site Scripting vulnerability in Snipe-IT
    High · 8.7 CVE-2024-51093 <= 7.0.13 no fix
  16. Snipe-IT remote code execution
    High · 7.2 CVE-2024-48987 < 7.0.10 7.0.10
  17. Snipe-IT allows users to promote or demote themselves or other users
    High · 8.1 CVE-2024-5685 < 6.4.2 6.4.2
  18. Cross-Site Request Forgery (CSRF) in snipe/snipe-it
    High · 8.8 CVE-2023-5511 < 6.2.3 6.2.3
  19. snipe-IT vulnerable to host header injection
    High · 8.8 CVE-2022-23064 >= 3.0-alpha, < 5.3.8 5.3.8
  20. Old sessions not blocked by login enable function in Snipe-IT
    High · 7.4 CVE-2022-1155 >= 6.0.0-RC-1, < 6.0.0-RC-6, < 5.4.2 6.0.0-RC-6, 5.4.2
  21. Improper Privilege Management in Snipe-IT
    High · 8.8 CVE-2022-0611 < 5.3.11 5.3.11
  22. snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2021-4130 < 5.3.6 5.3.6
  23. Server-Side Request Forgery in snipe/snipe-it
    High · 7.2 CVE-2021-4075 < 6.0.0-GM 6.0.0-GM
  24. Cross-site Scripting in snipe/snipe-it
    High · 8.0 CVE-2021-3961 < 5.3.2 5.3.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.