CVE-2026-55515

Published: Jul 10, 2026Modified: Jul 14, 2026

5.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Exploitability: 3.1 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.

Affected (1)

Products: Snipeitapp: Snipe It

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Snipeitapp Snipe It	Before 8.6.2

Related CWEs

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

https://github.com/grokability/snipe-it/commit/802067f3987a4b65bfc2efe60e22e07c24e01e6a

Source: security-advisories@github.com

Patch

https://github.com/grokability/snipe-it/releases/tag/v8.6.2

Source: security-advisories@github.com

Release Notes

https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg

Source: security-advisories@github.com

ExploitPatchVendor Advisory

https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitPatchVendor Advisory

Timeline

No history available yet.