Recommended action

Update snipe/snipe-it to 8.4.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update affects snipe/snipe-it (composer). Severity is medium. ### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update snipe/snipe-it to 8.4.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update affects snipe/snipe-it (composer). Severity is medium. ### Impact The `BulkAssetsController::update()` method accepts `company_id` directly from user input without calling `Company::getIdForCurrentUser()`, the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation. ### Patches Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

AI coding agents often install or upgrade packages automatically in composer. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software