【中危】snipe-it 安全更新（GHSA-33g4-646g-qwmm）

安全情报快照 · 风险级别：中危 · CVSS：6.3 · CVE-2026-55482 · GHSA-33g4-646g-qwmm

先看结论

snipe-it存在安全风险，<= 8.4.1 受影响，建议升级至 8.4.2。

影响范围

处置建议

优先将 snipe/snipe-it 升级至 8.4.2 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Impact

The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.

Patches

Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

来源与许可

• GitHub Advisory GHSA-33g4-646g-qwmm
• https://github.com/grokability/snipe-it/security/advisories/GHSA-33g4-646g-qwmm
• https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。