CVE-2026-55476 Details
Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
A vulnerability in Snipe-IT versions prior to 8.6.0 allows authenticated users to misuse the 'cancel_by_admin' URL parameter. Without proper authorization, they can cancel pending asset requests for other users. This issue arises because the 'cancel_by_admin' parameter is accepted as a plain URL path segment without sufficient authorization checks. The vulnerability is exploited by sending a request with a victim's user ID, effectively canceling their asset requests without notification.
Users can upgrade to Snipe-IT version 8.6.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| snipeitapp snipe-it | < 8.6.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | Initial Analysis | [email protected] |
| Jul 10, 2026 | New CVE Received | [email protected] |