What is the CVSS score of CVE-2026-54329?

CVE-2026-54329 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Snipe-IT are affected by CVE-2026-54329?

Snipe-IT versions 8.6.1 and earlier contain a cross-tenant data injection vulnerability in the Accessories API that allows authenticated users to inject asset records into other company inventories…. A patch is available.

How to fix or mitigate CVE-2026-54329?

Within 24 hours: Verify if Full Multiple Companies Support (FMCS) is enabled and confirm current Snipe-IT version (vulnerable if 8.6.1 or earlier). Within 7 days: Upgrade Snipe-IT to the latest available version from the vendor. Within 30 days: Complete validation testing and review audit logs for cross-tenant data anomalies dating back to initial deployment.

Snipe-IT CVE-2026-54329

EUVD-2026-42982 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-23 https://github.com/grokability/snipe-it

GHSA-pwpj-p52h-q484

Code Injection

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

7.7 HIGH

Network API reachable with low-privilege auth and no interaction (AV:N/AC:L/PR:L/UI:N); crossing the tenant boundary justifies S:C with high integrity and no confidentiality/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 10, 2026 - 20:33 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 10, 2026 - 20:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 10, 2026 - 20:22 vuln.today

cvss_changed

CVSS changed

Jul 10, 2026 - 20:22 NVD

8.5 (HIGH) 7.7 (HIGH)

Source Code Evidence Fetched

Jun 23, 2026 - 23:51 vuln.today

Analysis Generated

Jun 23, 2026 - 23:51 vuln.today

DescriptionNVD

Impact

A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.

The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.

As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.

Patches

Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5

AnalysisAI

Cross-tenant data injection in the Snipe-IT Accessories API (versions <= 8.6.1) lets a low-privileged authenticated user in one company write persistent accessory records into another company's inventory by supplying a foreign company_id in the API request body. The flaw only manifests when Full Multiple Companies Support (FMCS) is enabled, and it breaks tenant isolation because the API store/update path mass-assigns company_id without the enforcement the web UI applies. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with low-privilege API token

Delivery

Craft accessory create request with foreign company_id

Exploit

POST to Accessories API store endpoint

Execution

Mass-assignment persists record under Company B

Impact

Injected accessory appears as Company B inventory

Access

Authenticate with low-privilege API token

Delivery

Craft accessory create request with foreign company_id

Exploit

POST to Accessories API store endpoint

Execution

Mass-assignment persists record under Company B

Impact

Injected accessory appears as Company B inventory

Vulnerability AssessmentAI

Exploitation	Exploitation requires that Full Multiple Companies Support (FMCS) is enabled on the Snipe-IT instance - on single-company deployments the company_id has no cross-tenant meaning and the flaw does not apply. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N (7.7, High) is internally consistent with the description: network-reachable API, low complexity, low-privilege authenticated attacker, no user interaction, scope change reflecting the crossed tenant boundary, and high integrity impact with no confidentiality or availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker holding a normal API token for Company A on an FMCS-enabled Snipe-IT instance sends a POST to the accessories API create endpoint with a body that includes company_id set to Company B's identifier. The server mass-assigns that value and persists the accessory under Company B, where it then appears to Company B staff as legitimate inventory. …
Remediation	Vendor-released patch: upgrade to Snipe-IT 8.6.2 or later (https://github.com/grokability/snipe-it/releases/tag/v8.6.2), which enforces Company::getIdForCurrentUser() on API create and update for accessories, components, consumables, departments, and licenses (fix commit https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5); see advisory https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484. … Detailed patch versions, workarounds, and compensating controls in full report.