PT-2026-57268 · Snipe-It · Snipe-It

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55476

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.0

Description An authenticated user can silently cancel pending asset requests of another user due to insufficient authorization. This occurs when the system processes the cancel by admin URL path segment in the 'POST /account/request/{itemType}/{itemId}/{cancel by admin?}/{requestingUser?}' endpoint, allowing the attacker to specify a victim user ID.

Recommendations Update to version 8.6.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-55476

Affected Products

Snipe-It

References · 7

• https://github.com/grokability/snipe-it/commit/ac2162113d9e25e4c61b61916ce67fb2a1050553 · Patch
• https://github.com/grokability/snipe-it/commit/3c1b18919afbba12d419a9795929493b0391c91a · Patch
• https://github.com/grokability/snipe-it/security/advisories/GHSA-53jc-27pc-x8r8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55476 · Security Note
• https://github.com/grokability/snipe-it/releases/tag/v8.6.0 · Note
• https://twitter.com/infoflowcloud/status/2075667854075015249 · Twitter Post
• https://twitter.com/CVEnew/status/2075666965687923172 · Twitter Post