CVE-2026-55476: Snipe-IT Auth Bypass Vulnerability

CVE-2026-55476 Overview

CVE-2026-55476 is a missing authorization vulnerability [CWE-862] in Snipe-IT, an open-source IT asset and license management system maintained by Grokability. Versions prior to 8.6.0 expose the endpoint POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}, which accepts the cancel_by_admin flag as a URL path segment without validating whether the caller holds administrative privileges. An authenticated user can supply another user's ID as requestingUser and silently cancel that victim's pending asset requests. The issue is resolved in version 8.6.0.

Critical Impact
Any authenticated Snipe-IT user can cancel pending asset requests belonging to other users, disrupting asset provisioning workflows without triggering visible warnings to the victim.

Affected Products

Snipe-IT versions prior to 8.6.0
Grokability Snipe-IT self-hosted deployments
Snipe-IT containerized deployments running affected versions

Discovery Timeline

2026-07-10 - CVE-2026-55476 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-55476

Vulnerability Analysis

The vulnerability resides in ViewAssetsController inside the request cancellation flow. The route POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts two optional path segments controlled entirely by the caller. The original logic checked whether the current user had a pending request for the item or whether the cancel_by_admin flag was set, but never verified that the caller actually held administrative authorization when that flag was used.

As a result, a low-privileged authenticated user could submit a request setting cancel_by_admin to a truthy value and requestingUser to a victim's user identifier. The controller then invoked cancelRequest($requestingUser) on behalf of the victim, removing the victim's pending asset request from the queue. This is a broken access control issue that impacts request workflow integrity without exposing data confidentiality.

Root Cause

The root cause is a missing authorization check on a privileged code path. The controller treated cancel_by_admin as trusted input rather than gating the branch behind an authorize() policy check. The fix introduces an explicit $this->authorize('index', Asset::class) call whenever cancel_by_admin is set, and passes null to cancelRequest when the caller is not an admin.

Attack Vector

Exploitation requires an authenticated Snipe-IT session with any user role. The attacker crafts a POST request to the vulnerable endpoint including a victim user ID as the requestingUser path segment. No user interaction from the victim is required, and no elevated privileges are needed on the attacker's account.

php

// Patch: app/Http/Controllers/ViewAssetsController.php
// Adds authorization gate and prevents privileged parameter passthrough

$settings = Setting::getSettings();

if ($cancel_by_admin) {
    $this->authorize('index', Asset::class);
}

if (($item_request = $item->isRequestedBy($user)) || $cancel_by_admin) {
    $item->cancelRequest($cancel_by_admin ? $requestingUser : null);
    $data['item_quantity'] = ($item_request) ? $item_request->qty : 1;
    $logaction->logaction(ActionType::RequestCanceled);

Source: Snipe-IT commit ac21621

Detection Methods for CVE-2026-55476

Indicators of Compromise

Application logs showing ActionType::RequestCanceled entries where the acting user is not an administrator.
HTTP POST requests to /account/request/{itemType}/{itemId}/{cancel_by_admin}/{requestingUser} with a non-null fourth path segment originating from non-admin sessions.
Unexpected cancellation of pending asset requests reported by end users without corresponding admin activity.

Detection Strategies

Parse Snipe-IT action logs and correlate RequestCanceled events against the acting user's role to flag cancellations performed by non-admins on behalf of other users.
Deploy a web application firewall rule matching POST requests to /account/request/*/*/*/* with four populated path segments.
Review database action_logs entries for a spike of cancellations attributed to a single low-privileged account.

Monitoring Recommendations

Enable verbose logging in Snipe-IT and forward events to a centralized log platform for role-aware analysis.
Alert on any request cancellation where target_id differs from the actor's own user ID and the actor lacks the admin role.
Baseline normal cancellation volumes per user and alert on statistical deviations.

How to Mitigate CVE-2026-55476

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.0 or later without delay.
Audit action_logs for suspicious RequestCanceled entries created before the upgrade.
Review and restrict Snipe-IT user accounts, removing dormant or unnecessary authenticated sessions.

Patch Information

The vulnerability is fixed in Snipe-IT 8.6.0. The remediation is delivered through commits 3c1b189 and ac21621, which add an explicit authorize('index', Asset::class) call and prevent unprivileged callers from passing requestingUser into cancelRequest. See the GitHub Security Advisory GHSA-53jc-27pc-x8r8 and the v8.6.0 release notes.

Workarounds

If immediate patching is not possible, block the vulnerable route pattern at a reverse proxy or WAF for non-admin sessions.
Restrict Snipe-IT access to trusted internal networks or place it behind an authenticating proxy that enforces role checks.
Temporarily reduce the number of low-privileged accounts with active sessions until the upgrade is applied.

bash

# Example nginx rule blocking the vulnerable path shape with 4 segments
location ~ ^/account/request/[^/]+/[^/]+/[^/]+/[^/]+/?$ {
    return 403;
}