high · 7.7CVE-2026-55516Aug 28, 2026

CVE-2026-55516: Snipe-IT Cross-Company Asset Maintenance Re-Parenting via API

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

An authenticated Snipe-IT API user can move a maintenance record onto an asset belonging to a different company, breaking tenant isolation in multi-company deployments.

Packagesnipe/snipe-it
Ecosystemcomposer
Affected<= 8.6.1
Fixed in8.6.2
CVE-2026-55516: Snipe-IT Cross-Company Asset Maintenance Re-Parenting via API

The problem

In multi-company (FMCS) deployments, the PATCH /api/v1/maintenances/{maintenance_id} endpoint authorizes the request against the maintenance record's current asset, then blindly accepts all request-body fields including asset_id.

Because asset_id is fillable on the AssetMaintenance model and the new value is never checked against the caller's company scope, a Company A user can re-parent the record to any asset in Company B. This corrupts maintenance history, cost, audit, and warranty records for the victim company.

Proof of concept

A working proof-of-concept for CVE-2026-55516 in snipe/snipe-it, with the exact payload below.

http
PATCH /api/v1/maintenances/42 HTTP/1.1
Host: snipe-it.example.com
Authorization: Bearer <valid_api_token_company_a>
Content-Type: application/json

{
  "asset_id": 9999
}

The vulnerable code in app/Http/Controllers/Api/MaintenancesController.php calls $maintenance->fill($request->all()) then $maintenance->save() after only authorizing against the original asset. Because asset_id is in the model's fillable array, the attacker-supplied value is written directly to the database without a second company-scope check.

The patch at commit 905d498 adds an authorization gate on the newly supplied asset_id before the record is saved, matching the pattern used elsewhere in the controller. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key): the attacker controls the key that determines the target resource, and the application fails to re-authorize after the key changes.

The fix

Upgrade to Snipe-IT 8.6.2 or later. The patch (commit 905d498) adds a company-scope authorization check against the incoming asset_id before the maintenance record is saved. No configuration workaround exists for earlier versions.

Reporter not attributed.

References: [1][2][3][4][5]

Related research