| Package | Affected versions | Patched versions |
|---|---|---|
| snipe/snipe-it | < 8.4.2 | 8.4.2 |
| snipe-it | < 8.4.1 | 8.4.1 |
The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.
Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free