In a multi-company environment where strict tenant isolation is expected, the application correctly validates access to the existing maintenance record and its associated asset during the update process. However, it fails to perform secondary authorization checks on the newly supplied asset_id provided in the request body. This allows an authenticated user with maintenance modification permissions to re-parent a maintenance record to an asset belonging to a different company to which they should not have access. This flaw compromises the integrity of asset lifecycle records and enables unauthorized cross-company modification.

Attack Chain

1. Attacker authenticates to the Snipe-IT web application using a legitimate API token with maintenance management permissions.
2. Attacker retrieves or identifies a maintenance_id currently associated with an asset within their authorized company scope.
3. Attacker identifies the asset_id of a victim asset belonging to a different company (the target).
4. Attacker constructs a PATCH or PUT request to /api/v1/maintenances/{maintenance_id}.
5. Attacker includes the target asset_id in the request body JSON payload.
6. The MaintenancesController validates access to the initial asset but fails to validate the new asset_id against the user's company scope.
7. The application executes $maintenance->save(), committing the unauthorized association to the database.
8. The victim company's asset records are now polluted with the attacker-controlled maintenance entry.

Impact

The vulnerability results in a loss of data integrity for multi-company deployments by bypassing tenant isolation. Attackers can pollute asset history across company boundaries, leading to incorrect warranty, audit, and maintenance tracking. This may also be used to obfuscate asset history or generate fraudulent maintenance records for assets owned by other entities within the same Snipe-IT instance.

Recommendation

1. Upgrade to a version of Snipe-IT that resolves CVE-2026-55516.
2. Review application logs for API calls to MaintenancesController originating from low-privilege accounts that involve asset_id changes to determine if cross-company record movement has occurred.
3. If immediate patching is not possible, restrict API access for non-administrative accounts until a fix is deployed.