GHSA-575R-357H-FHCH
Vulnerability from github – Published: 2026-08-28 18:06 – Updated: 2026-08-28 18:06Impact
The API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope.
In a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or move a maintenance record onto an asset belonging to Company B. The endpoint appears to authorize access to the existing maintenance record’s asset, but does not re-authorize the newly supplied asset_id before saving the update.
Affected endpoint
PATCH /api/v1/maintenances/{maintenance_id}
Also likely affected:
PUT /api/v1/maintenances/{maintenance_id}
Preconditions
The attacker needs: - A valid authenticated API token. - Permission to update asset maintenance records. - Access to a maintenance record currently attached to an asset in their own company.
The attacker does not need access to the target asset’s company.
Root cause
In the API maintenance update flow, the application checks access to the current maintenance record / current asset, then accepts attacker-controlled fields including asset_id.
The vulnerable behavior is that the new asset_id is not checked against the current user’s company scope before being saved.
Relevant code path:
app/Http/Controllers/Api/MaintenancesController.php
The update method loads the maintenance, checks access to the existing $maintenance->asset, then calls:
$maintenance->fill($request->all());
$maintenance->save();
Since asset_id is fillable on the maintenance model, the attacker can re-parent the record to another company’s asset.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Security impact
This breaks tenant/company isolation in multi-company deployments. A scoped user can write maintenance records against assets outside their authorized company boundary.
Potential impact includes: - Cross-company asset history pollution. - Unauthorized modification of another company’s asset maintenance timeline. - Incorrect maintenance, cost, audit, and warranty records on victim-company assets. - Loss of integrity in asset lifecycle records.
This is not intended functionality because the application’s company-scoping model should prevent users from writing records onto inaccessible assets.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.6.1"
},
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55516"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T18:06:05Z",
"nvd_published_at": "2026-07-10T19:17:25Z",
"severity": "HIGH"
},
"details": "### Impact\nThe API endpoint for updating asset maintenance records allows an authorized user to change the asset_id of an existing maintenance record to an asset outside their company scope.\n\nIn a Full Multiple Company Support / multi-company deployment, this allows a user from Company A to attach or move a maintenance record onto an asset belonging to Company B. The endpoint appears to authorize access to the existing maintenance record\u2019s asset, but does not re-authorize the newly supplied asset_id before saving the update.\n\n### Affected endpoint\n`PATCH /api/v1/maintenances/{maintenance_id}`\n\nAlso likely affected:\n\n`PUT /api/v1/maintenances/{maintenance_id}`\n\n### Preconditions\nThe attacker needs:\n- A valid authenticated API token.\n- Permission to update asset maintenance records.\n- Access to a maintenance record currently attached to an asset in their own company.\n\nThe attacker does not need access to the target asset\u2019s company.\n\n### Root cause\nIn the API maintenance update flow, the application checks access to the current maintenance record / current asset, then accepts attacker-controlled fields including `asset_id`.\n\nThe vulnerable behavior is that the new asset_id is not checked against the current user\u2019s company scope before being saved.\n\n### Relevant code path:\n`app/Http/Controllers/Api/MaintenancesController.php`\n\nThe update method loads the maintenance, checks access to the existing $maintenance-\u003easset, then calls:\n```php\n$maintenance-\u003efill($request-\u003eall());\n$maintenance-\u003esave();\n```\n\nSince `asset_id` is fillable on the maintenance model, the attacker can re-parent the record to another company\u2019s asset.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### Security impact\nThis breaks tenant/company isolation in multi-company deployments. A scoped user can write maintenance records against assets outside their authorized company boundary.\n\nPotential impact includes:\n- Cross-company asset history pollution.\n- Unauthorized modification of another company\u2019s asset maintenance timeline.\n- Incorrect maintenance, cost, audit, and warranty records on victim-company assets.\n- Loss of integrity in asset lifecycle records.\n\nThis is not intended functionality because the application\u2019s company-scoping model should prevent users from writing records onto inaccessible assets.",
"id": "GHSA-575r-357h-fhch",
"modified": "2026-08-28T18:06:05Z",
"published": "2026-08-28T18:06:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-575r-357h-fhch"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55516"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/905d498ecdb0ee5591231c97bf48435e92044368"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.