CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.0 are vulnerable to unauthorized cancellation of pending asset requests, as the application improperly handles the `cancel_by_admin` URL path segment. This flaw allows authenticated users to exploit the system by canceling requests on behalf of other users without proper authorization, potentially disrupting asset management processes. Organizations using Snipe-IT should prioritize upgrading to version 8.6.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)