Vulnerability Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Snipeitapp | Snipe-It | < 8.6.2 |
Related Weaknesses (CWE)
References
- https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632Patch
- https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f8Patch
- https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cPatch
- https://github.com/grokability/snipe-it/releases/tag/v8.6.2Release Notes
- https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484PatchVendor Advisory
FAQ
What is CVE-2026-54329?
CVE-2026-54329 is a vulnerability with a CVSS score of 8.5 (HIGH). Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing ...
How severe is CVE-2026-54329?
CVE-2026-54329 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54329?
Check the references section above for vendor advisories and patch information. Affected products include: Snipeitapp Snipe-It.