EUVD-2026-56949
GHSA-9g74-jcx5-95fc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires only low-privilege authentication (PR:L); no scope change, no confidentiality impact, limited integrity and availability impact from workflow disruption.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.
AnalysisAI
Authorization bypass in Snipe-IT before 8.6.0 allows any authenticated low-privileged user to cancel other users' pending asset checkout requests by supplying arbitrary values in URL path segments. The checkout-request cancellation endpoint reads cancel_by_admin and requestingUser directly from user-controlled URL segments without server-side ownership validation, enabling any logged-in user to bypass request-ownership checks. Because asset and user identifiers are sequential integers, a determined attacker can enumerate the full ID space and systematically cancel every pending checkout request platform-wide, disrupting the asset-management workflow. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is confirmed in v8.6.0, reported by Tenable (TRA-2026-54).
Technical ContextAI
Snipe-IT is an open-source IT asset management application maintained by Grokability (CPE: cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:*). The flaw resides in the asset checkout-request cancellation HTTP endpoint, which reads the cancel_by_admin and requestingUser control values directly from URL path segments rather than from server-enforced session context. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) - a subclass of IDOR where the application trusts an attacker-supplied identifier to authorize a resource operation without verifying ownership on the server side. The presence of non-empty cancel_by_admin in the URL is sufficient to suppress the ownership check that would otherwise restrict cancellation to the originating user. Compounding the risk, both asset and user identifiers are exposed as sequential integers in the URL, making exhaustive enumeration of valid targets straightforward without any prior reconnaissance.
RemediationAI
Vendor-released patch: Snipe-IT 8.6.0. Upgrade to v8.6.0 or later from https://github.com/snipe/snipe-it/releases/tag/v8.6.0, which resolves the authorization bypass by implementing proper server-side ownership verification on the cancellation endpoint. Before upgrading, verify that the host PHP version meets the minimum requirement of PHP 8.2.0 (PHP 8.4+ is recommended by the vendor); failure to meet this requirement will prevent v8.6.0 from running. If an immediate upgrade is not feasible, restrict network-layer access to the checkout-request cancellation endpoint to trusted internal IP ranges only, reducing the pool of potential attackers to those with network adjacency - note this does not eliminate risk from insider threats. Additionally, audit application logs for anomalous cross-user cancellation activity to detect exploitation attempts. No vendor-documented configuration-based workaround exists beyond patching.
Cross-Site Request Forgery (CSRF) in GitHub repository snipe/snipe-it prior to v.6.2.3. Rated high severity (CVSS 8.8),
In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. Rated high severity (CVSS 8.8), this
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remot
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF). Rated high severity (CVSS 8.8), this vulnerability is remot
Two-factor authentication bypass in Snipe-IT (all releases before 8.7.0) allows an attacker who already knows a victim's
Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. Rated high severity (CVSS 8.0), this vulnerability
Old sessions are not blocked by the login enable function. Rated high severity (CVSS 7.4), this vulnerability is remotel
snipe-it is vulnerable to Server-Side Request Forgery (SSRF). Rated high severity (CVSS 7.2), this vulnerability is remo
Privilege escalation via authorization bypass in Snipe-IT versions prior to 8.6.0 allows any authenticated user holding
Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the AP
Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. Rated medium severity (CVSS 6.5), this vulnera
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated me
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today