【高危】snipe-it 安全更新（GHSA-pwpj-p52h-q484）

安全情报快照 · 风险级别：高危 · CVSS：8.5 · CVE-2026-54329 · GHSA-pwpj-p52h-q484

先看结论

snipe-it存在安全风险，<= 8.6.1 受影响，建议升级至 8.6.2。

影响范围

处置建议

优先将 snipe/snipe-it 升级至 8.6.2 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Impact

A cross-tenant data injection vulnerability was identified in the Snipe-IT Accessories API when Full Multiple Companies Support (FMCS) is enabled. A low-privileged authenticated user belonging to one company can create an accessory record under another company by supplying a foreign company_id value in the API request body.

The issue occurs because the API create path mass-assigns request parameters directly to the Accessory model, and the Accessory model allows company_id to be mass assigned. Unlike the web controller, which uses Company::getIdForCurrentUser() to enforce the authenticated user’s company context, the API controller does not apply equivalent tenant enforcement during accessory creation.

As a result, a Company A user can inject persistent accessory records into Company B. The injected records are then visible to Company B users as legitimate Company B inventory records. This breaks the integrity of company-scoped inventory data and represents a tenant isolation failure in the accessory creation flow.

Patches

Patched in https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5

来源与许可

• GitHub Advisory GHSA-pwpj-p52h-q484
• https://github.com/grokability/snipe-it/security/advisories/GHSA-pwpj-p52h-q484
• https://github.com/grokability/snipe-it/commit/dc8cbf4786bb38b260b4ae1723ec9e7f81d82fe5

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。