CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference, CWE-639) in the asset checkout-request cancellation endpoint, where the cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check. An authenticated, low-privileged user can submit a cancellation request with a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending asset checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the organization's asset-request workflow. Any Snipe-IT deployment running a version earlier than 8.6.0 is affected, with risk limited to instances that grant accounts to low-privileged users. No in-the-wild exploitation is known; a public proof-of-concept reference is available via Tenable Research (TRA-2026-54), EPSS is low at 0.3% (20th percentile), and the flaw is not in CISA KEV, with a medium CVSS 4.0 score of 5.3.

What to do: Upgrade to Snipe-IT 8.6.0 or later, which restores the server-side authorization check on the checkout-request cancellation endpoint. Because exploitation requires a low-privileged authenticated account, prioritize patching instances exposed to untrusted or shared users; details and the PoC are documented in Tenable Research advisory TRA-2026-54.