CVE-2026-55476: Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
Impact The route POST /account/request/{itemType}/{itemId}/{cancelbyadmin?}/{requestingUser?} accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.
Patches Patched in 8.6.1
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancelbyadmin?}/{requestingUser?} accepts cancelbyadmin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.0 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.0 - Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55476?
CVE-2026-55476 has a risk rating of 35.
What systems are affected by CVE-2026-55476?
CVE-2026-55476 affects Snipe-IT versions prior to 8.6.0.
How do I fix CVE-2026-55476?
To remediate CVE-2026-55476, upgrade Snipe-IT to version 8.6.0 or later.
What type of vulnerability is CVE-2026-55476?
CVE-2026-55476 is an unauthorized access vulnerability in the Snipe-IT asset management system.
What impact does CVE-2026-55476 have on users?
CVE-2026-55476 allows authenticated users to cancel asset requests for other users without proper authorization.