Executive brief
Snipe-IT is an asset management system used to track IT equipment and manage checkout workflows. A vulnerability allows users with basic report-viewing permissions to delete pending checkout acceptance records belonging to other companies, bypassing the intended company-level access controls. This could allow attackers to suppress audit trails showing that users have not accepted custody of assets, disrupting asset handoff and compliance processes.
Technical details
The vulnerability is an authorization bypass in the report delete endpoint (CWE-639). The delete action in the unaccepted assets report verifies only that the user has `reports.view` permission, then deletes a CheckoutAcceptance record by its global ID without validating that the user's company can access the related asset. The root cause is missing scope validation: the code calls `$this->authorize('reports.view')` followed by `CheckoutAcceptance::pending()->find($acceptanceId)->delete()` without checking whether the current user can access the checkoutable asset's company. Attack requires network access and valid authentication credentials, plus knowledge of a pending acceptance ID (which are sequential/guessable). An authenticated user with only `reports.view` permission can delete acceptances across company boundaries, tamper with asset handoff workflows, and destroy evidence of pending acceptance status.
Affected products
- Snipe-IT Snipe-IT <= 8.6.1
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Version 8.6.2 released