What is the CVSS score of CVE-2026-55515?

CVE-2026-55515 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-55515?

Yes, a public proof-of-concept exploit is available for CVE-2026-55515. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-55515?

Yes, a patch is available for CVE-2026-55515. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55515

EUVD-2026-42995 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-10 security-advisories@github.com

GHSA-35cr-9hqq-p2mg

Authentication Bypass Snipe It Snipeitapp

5.0

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

vuln.today AI

5.0 MEDIUM

PR:L confirmed by required reports.view role; S:C reflects cross-tenant record deletion; I:L only since impact is confined to deleting acceptance records with no confidentiality or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:48 vuln.today

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.

AnalysisAI

Cross-tenant authorization bypass in Snipe-IT prior to v8.6.2 allows an authenticated user with only reports.view permission in one company to delete pending checkout acceptance records belonging to any other company by supplying arbitrary global IDs to the unaccepted-assets report delete endpoint. The root cause is a classic IDOR (CWE-639): the endpoint validates role but not company-scope ownership. No public exploit has been identified and this CVE is absent from the CISA KEV catalog, but multi-tenant deployments relying on organizational data isolation are directly impacted.

Technical ContextAI

Snipe-IT is an open-source PHP/Laravel IT asset and license management system supporting multi-company (multi-tenant) deployments where distinct organizations share one instance with isolated data. The vulnerable endpoint handles deletion of CheckoutAcceptance records - database rows representing pending approvals for asset checkouts. The delete handler resolves records via CheckoutAcceptance::pending()->find($acceptanceId) using a globally scoped ORM query, then authorizes the action by checking only the reports.view permission without asserting that the acceptance record's related checkoutable asset belongs to the requesting user's company. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes this flaw: the application trusts a user-supplied integer ID to identify a resource without enforcing ownership or tenancy boundaries. Because database primary keys are typically sequential integers, enumeration is trivially feasible.

RemediationAI

Upgrade to Snipe-IT v8.6.2 or later, which introduces company-scope validation on the unaccepted-assets delete endpoint. The patching commit is 802067f3987a4b65bfc2efe60e22e07c24e01e6a (https://github.com/grokability/snipe-it/commit/802067f3987a4b65bfc2efe60e22e07c24e01e6a) and the release is at https://github.com/grokability/snipe-it/releases/tag/v8.6.2. If immediate patching is not feasible for a multi-company instance, revoke or restrict the reports.view permission from user accounts that belong to a company that should not interact with other tenants' data - this reduces the pool of accounts that could be misused, though it may limit legitimate reporting workflows. Alternatively, restrict network access to the Snipe-IT admin interface to trusted internal segments via firewall rules, reducing the exposure to users already on the internal network; note this does not eliminate insider risk. There is no documented vendor-supported workaround other than upgrading to v8.6.2.