Security Intune Tab Company Check

Security: the asset's Intune tab did not check the asset's company

Fixed in 5.3.0 · Found while reviewing PR #338 · Present in releases up to and including 5.2.0 · Affects multi-company installs only · Module: Assets

---

Timeline

Date	What happened
14 November 2026	Found while reviewing PR #338, which added the primary-user history to the same tab. The endpoint itself was much older - it had read the Intune device row without a company check since the Intune tab was first written, before 1.0.0.
14 November 2026	Fixed and released in 5.3.0, the same day.
15 November 2026	This write-up published.

Upgrading to 5.3.0 is the fix. Every release from 5.3.0 onwards has it. A single-company install was never affected - there is no other company to see.

The short version

On an asset's Intune tab, FreeITSM shows the device Intune reports for it - its name, the signed-in user, operating system, compliance, serial number, IMEI and network addresses. The page that supplies that tab checked that you were signed in and could use Assets, but not that the asset belonged to a company you can reach.

What that could do. On an install with more than one company, an analyst limited to some companies could ask for the Intune details of an asset in another company by its number, and get them. The asset itself - its name, holder and the rest of its record - stayed hidden, as it should; only the Intune device row came back.

Who could do it: a signed-in analyst with access to Assets on a multi-company install, who knew or guessed another company's asset numbers. It changed nothing - the page only reads.

Nothing to do beyond upgrading. There is no setting to change and nothing to clean up.

What was wrong

api/intune/get_intune_device.php looked the device up by the asset id it was given:

requireModuleAccessJson('assets');
$assetId = (int)($_GET['asset_id'] ?? 0);
// ...
SELECT ... FROM intune_devices WHERE asset_id = ? LIMIT 1

Every other tab of the asset - Users, History - first asks whether the analyst can reach the asset's company. This one did not, so it was the one door into another company's asset that was left open.

The fix

The same check as its neighbours, before anything is read; an asset in a company the analyst cannot reach answers "Asset not found", exactly as if it did not exist:

if (!analystCanAccessAsset($conn, (int)$_SESSION['analyst_id'], $assetId)) {
    echo json_encode(['success' => false, 'error' => 'Asset not found']);
    exit;
}

It also no longer returns the database's own error text when something goes wrong. tests/intune-user-history.php checks it over HTTP: an analyst limited to one company gets "Asset not found" for another company's asset, and the details for their own (the positive control).

Related

• Multi-company isolation - the rule every endpoint follows
• Assets → Intune integration
• 5.3.0 release notes