Snipe-IT has Multi-Tenancy Bypass via Bulk Asset Update
The BulkAssetsController::update() method accepts company_id directly from user input without calling Company::getIdForCurrentUser(), the standard company-scoping function used by every other controller in the codebase. A non-superadmin user can move assets across company boundaries, breaking multi-tenancy isolation.
Patched in https://github.com/grokability/snipe-it/commit/d58fda626e8febfeff4cabbc20ba03edfc411e18
Why this VPI (explainable, experimental)
VPI breakdown
| Impact | 63.00 |
| Exploitation signal(No additional exploitation signal) | ×1.00 |
| VPI | 63.00 |
VPI formula vpi-v1