CVE-2026-19579: Snipe-IT Auth Bypass Vulnerability

CVE-2026-19579 Overview

CVE-2026-19579 is an insecure direct object reference (IDOR) vulnerability in Snipe-IT versions prior to 8.6.0. The flaw resides in the asset checkout-request cancellation endpoint. The application reads the cancel_by_admin and requestingUser values directly from user-controlled URL path segments without performing a server-side authorization check. Any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check. This allows an attacker to cancel checkout requests belonging to other users. Because asset and user identifiers are sequential integers, an attacker can enumerate them and cancel every pending checkout request in the system. The issue is tracked as [CWE-639] and fixed in Snipe-IT 8.6.0.

Critical Impact
Authenticated low-privileged users can cancel any pending asset checkout request, disrupting the entire asset-request workflow across the organization.

Affected Products

Snipe-IT versions before 8.6.0
Self-hosted Snipe-IT asset management deployments
Snipe-IT instances exposing the checkout-request cancellation endpoint to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-19579 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-19579

Vulnerability Analysis

Snipe-IT is an open-source IT asset management application. The vulnerable endpoint handles cancellation of pending asset checkout requests. The controller reads two values, cancel_by_admin and requestingUser, from URL path segments controlled by the client. The application uses these values to determine whether the cancellation is authorized without validating that the requesting session actually owns the request or holds administrative privileges.

As a result, a low-privileged authenticated user can submit a cancellation request containing a non-empty cancel_by_admin value and bypass the ownership check entirely. Combined with sequential integer identifiers for assets and users, the flaw allows systematic enumeration and mass cancellation of pending requests. The impact is limited to integrity and availability of the asset-request workflow; confidentiality is not directly affected.

Root Cause

The root cause is trust in user-supplied path parameters for authorization decisions. The cancellation handler treats path segments as authoritative source-of-truth for identity and privilege state instead of consulting the authenticated session context. This matches the classic pattern documented in [CWE-639: Authorization Bypass Through User-Controlled Key].

Attack Vector

Exploitation requires a valid authenticated Snipe-IT account with any role. The attacker crafts HTTP requests to the checkout-request cancellation endpoint, populating the cancel_by_admin path segment with a non-empty value and iterating requestingUser and asset identifiers. Because identifiers are sequential, discovery is trivial through a simple loop. No user interaction is required and no elevated privileges are needed. See the Tenable Security Research Report for further technical detail.

Detection Methods for CVE-2026-19579

Indicators of Compromise

Sequential HTTP requests to the checkout-request cancellation endpoint iterating asset or user identifiers from a single authenticated session
Cancellation events in Snipe-IT audit logs where the actor is a low-privileged user but cancel_by_admin is set
Sudden bulk cancellations of pending checkout requests within a short time window

Detection Strategies

Review Snipe-IT application logs for cancellation requests where the acting user role does not match the cancel_by_admin flag semantics
Correlate web server access logs to identify sequential enumeration patterns against the cancellation route
Compare pending checkout request counts over time to spot abnormal drops

Monitoring Recommendations

Forward Snipe-IT audit logs and web server access logs to a centralized SIEM for long-term correlation
Alert on any authenticated user generating a high rate of cancellation requests against distinct request identifiers
Track user-to-request ratios for cancellation actions and flag outliers exceeding a defined threshold

How to Mitigate CVE-2026-19579

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.0 or later using the official GitHub Release v8.6.0
Audit recent checkout-request cancellation events to identify unauthorized cancellations and restore affected requests
Restrict Snipe-IT access to trusted networks or authenticated VPN sessions while the upgrade is planned

Patch Information

The vulnerability is fixed in Snipe-IT 8.6.0. The release enforces server-side authorization for checkout-request cancellations and no longer trusts user-controlled path segments for identity or privilege decisions. Administrators should follow the standard Snipe-IT upgrade procedure documented alongside the release notes.

Workarounds

Temporarily disable the asset checkout-request feature for non-administrative roles until the patch is applied
Place a reverse proxy or web application firewall rule in front of Snipe-IT that blocks requests to the cancellation endpoint when the acting session role does not permit administrative cancellation
Reduce the attack surface by limiting Snipe-IT accounts to the minimum necessary user population until upgrade

bash

# Example reverse proxy rule to block cancellation requests
# containing a non-empty cancel_by_admin segment from non-admin sessions.
# Adapt the location path and role header to your deployment.
location ~ ^/api/v1/.*/cancel_by_admin/[^/]+/ {
    if ($http_x_user_role != "admin") {
        return 403;
    }
    proxy_pass http://snipeit_backend;
}