CyberRota Analysis
AI-GeneratedThe Accessories API in Snipe-IT prior to version 8.6.2 is vulnerable to mass assignment, allowing low-privileged authenticated users to create accessory records for other companies when Full Multiple Companies Support is enabled. This could lead to unauthorized data manipulation and potential data leakage between companies. Organizations using Snipe-IT should prioritize upgrading to version 8.6.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)