CVE-2026-55476: Grokability Snipe-IT missing authorization in asset request cancellation

Executive brief

Snipe-IT is an open-source asset management system used to track and manage IT equipment across organizations. An authenticated user can exploit a missing authorization check to silently cancel other users' pending equipment requests, disrupting legitimate asset procurement workflows. This could be used maliciously to prevent colleagues from receiving necessary equipment or to interfere with business operations.

Technical details

The vulnerability is a missing authorization check (CWE-862) in the POST route /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}. The cancel_by_admin parameter is accepted as a plain URL path segment without validating whether the authenticated user has permission to cancel another user's requests. An attacker with any valid session can craft a request with cancel_by_admin=true and a victim's user ID to cancel that user's pending asset requests. No special privileges or user interaction is required beyond an active session. The issue is network-reachable and affects versions prior to 8.6.0, with a patch released in version 8.6.0.

Affected products

• Grokability Snipe-IT < 8.6.0

Timeline

• 2026-06-24: disclosed
• 2026-08-28: patched: version 8.6.0 released

References

• https://api.github.com/users/iltosec
• https://github.com/iltosec
• https://api.github.com/users/iltosec/gists%7B/gist_id%7D
• https://api.github.com/users/iltosec/repos
• https://avatars.githubusercontent.com/u/85459074?v=4
• https://api.github.com/users/iltosec/events%7B/privacy%7D