{"id":"CVE-2026-55643","aliases":["GHSA-c6w2-j4wq-mvwg"],"url":"https://o3.security/vulnerability/CVE-2026-55643","summary":"Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode","details":"### Impact\nDue to inconsistent authorization checks, a company-scoped user can bypass tenant boundaries to read, mutate, and soft-delete users who do not belong to any company (company_id = null). While direct instance authorization (isCurrentUserHasAccess) correctly denies access to these out-of-scope users, multiple API endpoints and bulk action web routes fail to enforce this restriction, relying instead on class-level permissions or broad scoped queries.\nImpact: \n\nA malicious user scoped to a specific company (e.g., Company A) can:\n\nData Leakage: Extract PII and assigned licenses of users outside their tenant via the API (/api/v1/users and `/api/v1/users/{id}/licenses)`.\n\nData Modification: Mutate out-of-scope user profiles (e.g., changing city, notes) via the /users/bulkeditsave web route.\n\nData Deletion & Asset Theft: Soft-delete out-of-scope users and transfer their assigned assets to themselves via the /users/merge web route.\n\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b,","published":"2026-08-19T18:25:39.007Z","modified":"2026-10-02T03:47:28.644798698Z","cvss":null,"epss":{"score":0.00259,"percentile":0.17173,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"snipe/snipe-it","fixedVersion":"8.6.3"}],"fix":{"url":"https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b","label":"grokability/snipe-it@fbe05a8"},"references":[{"type":"WEB","url":"https://github.com/grokability/snipe-it/releases/tag/v8.6.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55643.json"},{"type":"ADVISORY","url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-c6w2-j4wq-mvwg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55643"},{"type":"FIX","url":"https://github.com/grokability/snipe-it/commit/fbe05a8df4742729a9b0756c016d45f48246cc7b"},{"type":"PACKAGE","url":"https://github.com/grokability/snipe-it"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T03:47:28.644798698Z"}}