CVE-2026-55515CWE-639

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Medium · published July 10, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-10T19:36Z
EPSS history
Timeline
  • 10 JUL 19:36Z
    Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
    cvelistv5