{"id":"CVE-2026-55476","aliases":["GHSA-53jc-27pc-x8r8"],"title":"Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter","summary":"Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter","severity":"medium","cwe":["CWE-862"],"vendor":"snipe","product":"snipe/snipe-it","ecosystem":"composer","affected":["snipe/snipe-it < 8.6.0"],"patched":["snipe/snipe-it 8.6.0"],"published":"2026-08-28","updated":"2026-08-28","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-53jc-27pc-x8r8","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-53jc-27pc-x8r8"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55476"},{"url":"https://github.com/grokability/snipe-it/commit/3c1b18919afbba12d419a9795929493b0391c91a"},{"url":"https://github.com/grokability/snipe-it/commit/ac2162113d9e25e4c61b61916ce67fb2a1050553"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.6.0"},{"url":"https://github.com/advisories/GHSA-53jc-27pc-x8r8"}],"tags":["ghsa","composer"],"epss":0.002,"epssPercentile":0.10142,"ingestedAt":"2026-08-28T18:23:37.572Z","slug":"CVE-2026-55476","body":"## Overview\n\n### Impact\nThe route POST `/account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}` accepts `cancel_by_admin` as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.\n\n### Patches\nPatched in 8.6.1\n\n## Affected packages\n\n- `snipe/snipe-it < 8.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snipe/snipe-it 8.6.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}