GHSA-53jc-27pc-x8r8: Composer/snipe/snipe-it vulnerability
Impact The route POST /account/request/{itemType}/{itemId}/{cancelbyadmin?}/{requestingUser?} accepts cancelbyadmin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.
Patches Patched in 8.6.1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.6.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with an active session can exploit it. No elevated privileges or administrative permissions are required.
What does an attacker need to do?
The attacker must send a POST request to the affected account request route, set cancel_by_admin to a truthy value, and provide the target user's ID. This can silently cancel the victim's pending asset requests.
Which versions contain the fix?
The issue is patched in version 8.6.1.