CVE-2026-55515: Grokability Snipe-IT authorization bypass in unaccepted-assets report delete endpoint

CVE-2026-55515 · Severity: medium · CVSS 5 · Published 2026-07-10

Snipe-IT is an asset management system used to track IT equipment and manage checkout workflows. A vulnerability allows users with basic report-viewing permissions to delete pending checkout acceptance records belonging to other companies, bypassing the intended company-level access controls. This could allow attackers to suppress audit trails showing that users have not accepted custody of assets, disrupting asset handoff and compliance processes.

Technologies: snipe/snipe-it (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-55515 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55515 being exploited in the wild.
How severe is CVE-2026-55515?
Medium severity, with a CVSS score of 5, published 10 July 2026.
Which products and versions are affected?
snipe/snipe-it (Packagist) <= 8.6.1, ECOSYSTEM:introduced=0,fixed=8.6.2.
Is there a fix for CVE-2026-55515?
Yes. snipe/snipe-it (Packagist): upgrade to 8.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55515 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55515?
Check whether you run snipe/snipe-it (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • snipe/snipe-it (Packagist): upgrade to 8.6.2 or later
    composer require snipe/snipe-it:^8.6.2

Technical details

The vulnerability is an authorization bypass in the report delete endpoint (CWE-639). The delete action in the unaccepted assets report verifies only that the user has `reports.view` permission, then deletes a CheckoutAcceptance record by its global ID without validating that the user's company can access the related asset. The root cause is missing scope validation: the code calls `$this->authorize('reports.view')` followed by `CheckoutAcceptance::pending()->find($acceptanceId)->delete()` without checking whether the current user can access the checkoutable asset's company. Attack requires network access and valid authentication credentials, plus knowledge of a pending acceptance ID (which are sequential/guessable). An authenticated user with only `reports.view` permission can delete acceptances across company boundaries, tamper with asset handoff workflows, and destroy evidence of pending acceptance status.

Affected products

  • Snipe-IT Snipe-IT <= 8.6.1

Identifiers

  • CVE-2026-55515
  • GHSA-35cr-9hqq-p2mg

Timeline

  • 2026-08-28: disclosed
  • 2026-08-28: patched: Version 8.6.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.