Snipe-IT EUVD-2026-42995

Exploitation requires an authenticated user account assigned the reports.view permission in any company on the Snipe-IT instance - this is confirmed by the CVSS vector (PR:L) and the advisory description. The instance must be configured with multiple companies (multi-tenant deployment); single-company deployments are not meaningfully affected. The attacker must be able to reach the Snipe-IT web interface over the network (AV:N). ID enumeration is the only technical prerequisite, as Snipe-IT likely uses sequential integer primary keys. Exploitation is limited by: (1) requiring a valid authenticated session with at minimum reports.view access, (2) being scoped only to deleting pending CheckoutAcceptance records - read access to cross-company data or modification of asset records is not enabled by this flaw, and (3) having no impact on single-tenant instances where company isolation is not in use.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N = 5.0) is consistent with the vulnerability description: network-accessible, low complexity, requiring only a low-privileged reports.view account, with scope change reflecting cross-tenant impact. The moderate 5.0 score appropriately reflects the bounded integrity-only impact - no data is exposed (C:N) and bulk availability is unaffected (A:N). The scope change (S:C) is the most significant signal: it indicates the blast radius extends beyond the attacker's own tenant, which is a serious concern for shared-instance deployments. No EPSS data was provided in the input; exploitation probability cannot be quantified from available signals. This CVE is not in the CISA KEV catalog, and no POC is known, so active exploitation is not confirmed. Real-world risk is elevated specifically for multi-company Snipe-IT deployments; single-tenant instances are not meaningfully affected since all users already share the same company context.

An attacker with a reports.view account in Company A iterates sequential integer IDs against the unaccepted-assets report delete endpoint, targeting CheckoutAcceptance records whose IDs fall outside their own company's range. Because the endpoint only verifies the reports.view role and not company membership, deletion succeeds for records owned by Company B or any other tenant on the instance. The attacker systematically erases Company B's pending asset checkout approvals, disrupting their IT asset onboarding workflow. No public exploit code has been identified at time of analysis.