Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:snipeitapp:snipe-It:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

Broken Access Control in Snipe-IT Asset Maintenance API

An authenticated user in a multi-company Snipe-IT deployment can exploit an authorization flaw in the asset maintenance update API to re-parent records to assets owned by other companies, breaking tenant isolation.

Snipe-IT +1 web-application privilege-escalation multi-tenant web-application-vulnerability path-traversal cve-2026-55474 authorization-bypass
2r 2t 1c