---
id: CVE-2026-55476
aliases:
  - GHSA-53jc-27pc-x8r8
title: >-
  Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded
  cancel_by_admin Parameter
summary: >-
  Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded
  cancel_by_admin Parameter
severity: medium
cwe:
  - CWE-862
vendor: snipe
product: snipe/snipe-it
ecosystem: composer
affected:
  - snipe/snipe-it < 8.6.0
patched:
  - snipe/snipe-it 8.6.0
published: '2026-08-28'
updated: '2026-08-28'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-53jc-27pc-x8r8'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-53jc-27pc-x8r8
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55476'
  - url: >-
      https://github.com/grokability/snipe-it/commit/3c1b18919afbba12d419a9795929493b0391c91a
  - url: >-
      https://github.com/grokability/snipe-it/commit/ac2162113d9e25e4c61b61916ce67fb2a1050553
  - url: 'https://github.com/grokability/snipe-it/releases/tag/v8.6.0'
  - url: 'https://github.com/advisories/GHSA-53jc-27pc-x8r8'
tags:
  - ghsa
  - composer
epss: 0.00336
epssPercentile: 0.24229
ingestedAt: '2026-08-28T18:23:37.572Z'
---

## Overview

### Impact
The route POST `/account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}` accepts `cancel_by_admin` as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.

### Patches
Patched in 8.6.1

## Affected packages

- `snipe/snipe-it < 8.6.0`

## Remediation

Upgrade to a patched release:

- `snipe/snipe-it 8.6.0`