CVE-2026-55515: Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55515?
The severity of CVE-2026-55515 is categorized as medium with a score of 5.
How do I fix CVE-2026-55515?
To fix CVE-2026-55515, upgrade Snipe-IT to version 8.6.2 or later.
What type of vulnerability is CVE-2026-55515?
CVE-2026-55515 is a cross-company deletion vulnerability that affects the unscoped report endpoint in Snipe-IT.
What are the potential impacts of CVE-2026-55515?
The potential impacts of CVE-2026-55515 include unauthorized deletion of pending checkout acceptances across different companies.
Which software is affected by CVE-2026-55515?
CVE-2026-55515 affects Snipe-IT versions prior to 8.6.2.