CyberRota Analysis
AI-GeneratedThe vulnerability allows non-superadmin users in Snipe-IT versions prior to 8.4.1 to manipulate the company_id directly, enabling the unauthorized movement of assets across company boundaries and compromising multi-tenant isolation. This could lead to data leakage or unauthorized access to sensitive information. Organizations using Snipe-IT for asset management should prioritize upgrading to version 8.4.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to submit company_id directly without Company::getIdForCurrentUser(), allowing assets to be moved across company boundaries and breaking multi-tenant isolation. This issue is fixed in version 8.4.1.