php · snipe/snipe-itCritical
Snipe-IT Accessories API Cross-Tenant Data Injection (FMCS)
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled.
What changed
A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user can create an accessory record under another company by supplying a foreign company_id value in the API request body.
Who it affects
Users of Snipe-IT with Full Multiple Companies Support (FMCS) enabled, specifically those using the Accessories API.
What to do today
Apply the patch from commit dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5 immediately.
The trail
Collected→
Audited→
Written→
Published