Location Creation Bypass in Snipe-IT with FMC

Executive Summary

CVE-2026-55472 is a vulnerability in the Snipe-IT asset management system affecting versions 8.6.1 and earlier. When both Full Multiple Companies Support (FMCS) and scope_locations_fmcs are enabled, the API endpoint for creating locations fails to properly enforce company boundary validation.

Although the system detects an invalid parent/child company relationship, it does not immediately reject the request, allowing the creation of a child location under a parent location from a different company. This flaw enables cross-company parent/child relationships to be created in the location hierarchy, compromising company isolation.

The issue does not occur in the Web interface, which correctly rejects such relationships. The vulnerability has been patched in version 8.6.2.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when the API endpoint for creating locations allows a parent location from a different company to be assigned, bypassing company boundary validation.

To detect this vulnerability on your system, you can test the API location creation endpoint by attempting to create a location with a parent location belonging to a different company when Full Multiple Companies Support (FMCS) and scope_locations_fmcs are enabled.

If the API accepts and creates such a location without immediate rejection, your system is vulnerable.

Suggested command (using curl) to test the API endpoint might look like this:

• curl -X POST https://your-snipeit-instance/api/v1/locations -H "Authorization: Bearer YOUR_API_TOKEN" -H "Content-Type: application/json" -d '{"name": "Test Location", "parent_id": DIFFERENT_COMPANY_PARENT_ID, "company_id": YOUR_COMPANY_ID}'

If the response indicates success and the location is created despite the parent location belonging to a different company, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade your Snipe-IT installation to version 8.6.2 or later, where this vulnerability has been fixed.

The fix ensures that the API and web controllers properly validate that a location's parent belongs to the same company, preventing cross-company parent-child location creation.

Until you can upgrade, consider disabling Full Multiple Companies Support (FMCS) or scope_locations_fmcs features if feasible, to reduce exposure.

Additionally, monitor API usage for suspicious location creation requests that might violate company boundaries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by compromising the isolation between companies within the Snipe-IT system. It allows the creation of location entries that link parent and child locations across different companies, which violates intended company boundaries.

Such cross-company relationships can lead to confusion or errors in asset and license management, potentially affecting downstream business logic that relies on accurate company-specific data.

The vulnerability requires low privileges and no user interaction, and can be exploited over the network, making it a moderate risk.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows creation of child locations under parent locations from different companies, compromising company isolation within the Snipe-IT asset management system.

This cross-company data boundary violation could potentially lead to unauthorized access or mixing of company-specific data, which may impact compliance with regulations that require strict data segregation and protection, such as GDPR or HIPAA.

However, the CVE description and resources do not explicitly mention any direct impact or assessment related to compliance with these standards.

Useful 0 Not Useful 0