CVE-2026-54329

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54329", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-12T18:42:02.224Z", "datePublished": "2026-07-10T18:26:44.378Z", "dateUpdated": "2026-07-10T20:58:22.265Z"}, "containers": {"cna": {"title": "Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484"}, {"name": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3", "tags": ["x_refsource_MISC"], "url": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3"}, {"name": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5", "tags": ["x_refsource_MISC"], "url": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5"}, {"name": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268", "tags": ["x_refsource_MISC"], "url": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268"}, {"name": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"}], "affected": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"version": "< 8.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T18:26:44.378Z"}, "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2."}], "source": {"advisory": "GHSA-pwpj-p52h-q484", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T20:46:21.168886Z", "id": "CVE-2026-54329", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:58:22.265Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54329", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T20:46:21.168886Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T20:46:22.001Z"}}], "cna": {"title": "Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API", "source": {"advisory": "GHSA-pwpj-p52h-q484", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "< 8.6.2"}]}], "references": [{"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484", "name": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3", "name": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5", "name": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268", "name": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "name": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T18:26:44.378Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54329", "state": "PUBLISHED", "dateUpdated": "2026-07-10T20:58:22.265Z", "dateReserved": "2026-06-12T18:42:02.224Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T18:26:44.378Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "snipe-it", "vendor": "grokability", "versions": [{"status": "affected", "version": "< 8.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C0389D5-B8C4-48C1-8E1C-6CCC59B5B631", "versionEndExcluding": "8.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2."}, {"lang": "es", "value": "Snipe-IT es un sistema de gesti\u00f3n de activos/licencias de TI. Antes de la versi\u00f3n 8.6.2, la ruta de creaci\u00f3n de la API de Accesorios asigna masivamente par\u00e1metros de solicitud al modelo Accessory mientras que company_id es asignable masivamente, lo que permite a un usuario autenticado con bajos privilegios en una empresa crear registros de accesorios bajo otra empresa cuando el Soporte Completo para M\u00faltiples Empresas est\u00e1 habilitado. Este problema est\u00e1 solucionado en la versi\u00f3n 8.6.2."}], "id": "CVE-2026-54329", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54329", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T20:46:21.168886Z", "version": "2.0.3"}}]}, "published": "2026-07-10T19:17:24.440", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/grokability/snipe-it/commit/6a0ec6945126a79fc25c0990c99abe632db370c3"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/grokability/snipe-it/commit/e2bea57146eb3a3781b5eb21b69d7e04cc87c268"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "snipe-it", "source": "cna", "vendor": "grokability"}, "product": "snipe-it", "vendor": "grokability"}], "created": "2026-07-10T20:30:04.774068+00:00", "updated": "2026-08-01T12:30:04.121743+00:00", "vendors": ["grokability", "grokability$PRODUCT$snipe-it"]}