CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.0 are vulnerable to an authorization bypass in the asset checkout-request cancellation endpoint, allowing authenticated low-privileged users to cancel pending requests belonging to other users. This flaw arises from the use of user-controlled URL parameters without proper server-side authorization checks, enabling potential disruption of the asset-request workflow through enumeration of user and asset identifiers. Organizations using affected versions should prioritize upgrading to 8.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.