What is the CVSS score of EUVD-2026-62680?

EUVD-2026-62680 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-62680?

Yes, a patch is available for EUVD-2026-62680. Update the affected software to the latest version immediately.

Snipe-IT EUVD-2026-62680

| CVE-2026-55482 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-23 https://github.com/grokability/snipe-it

GHSA-33g4-646g-qwmm

Authentication Bypass

6.3

CVSS 3.1 · Vendor: https://github.com/grokability/snipe-it

Severity by source

Vendor (https://github.com/grokability/snipe-it) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Integrity rated High because unauthorized cross-tenant asset reassignment is a severe data isolation violation; availability is unimpacted as no data is deleted or service disrupted.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/grokability/snipe-it).

CVSS VectorVendor: https://github.com/grokability/snipe-it

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 23:51 vuln.today

Analysis Generated

Jun 23, 2026 - 23:51 vuln.today

DescriptionCVE.org

Impact

The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.

Patches

Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

AnalysisAI

Multi-tenancy isolation is broken in Snipe-IT versions through 8.4.1, allowing authenticated non-superadmin users to reassign assets across company boundaries via the bulk asset update endpoint. The root cause is that BulkAssetsController::update() accepts company_id directly from HTTP request input without applying the Company::getIdForCurrentUser() scoping guard used by every other controller in the codebase. A fix is confirmed in version 8.4.2 via commit d58fda626e8febfeff4cabbc20ba03edfc411e18; no public exploit or CISA KEV listing exists at time of analysis.

Technical ContextAI

Snipe-IT is an open-source IT asset management platform built on Laravel/PHP, distributed via Composer as snipe/snipe-it. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), a class of IDOR-adjacent flaw where the application trusts a user-supplied identifier to scope a privileged operation. The fix diff confirms that BulkAssetsController.php line 374 was passing $request->input('company_id') directly into the update array, bypassing the Company::getIdForCurrentUser() method that enforces tenant-boundary checks. The CPE pkg:composer/snipe_snipe-it pins the affected package. All other controllers in the codebase correctly call the scoping function, making this an isolated omission rather than a systemic architectural flaw.

RemediationAI

Vendor-released patch: 8.4.2. Upgrade Snipe-IT to version 8.4.2 or later, which corrects BulkAssetsController::update() to pass the user-supplied company_id through Company::getIdForCurrentUser() before writing it to the update array. The advisory is at https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm and the patch commit is at https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18. If immediate upgrade is not feasible, restrict the bulk asset update functionality to superadmin-role users only via application-level role permissions; this trade-off removes the cross-tenant risk but prevents non-admin users from performing bulk updates entirely. Single-tenant deployments where only one company exists in the Snipe-IT instance are not at material risk and may deprioritize the upgrade cycle accordingly.