CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS

0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-25)

CWEs

CWE-639, CWE-807

Published

2026-08-11

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Affected

• snipeitapp:snipe-it

References

• https://github.com/snipe/snipe-it/releases/tag/v8.6.0
• https://www.tenable.com/security/research/tra-2026-54

Check your stackJSON