Description

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-11T21:17:35.240Z",
  "pubdate": "2026-08-11T21:17:35.240Z",
  "executiveSummary": "An authorization bypass vulnerability, specifically an Insecure Direct Object Reference (IDOR), exists in the asset checkout-request cancellation endpoint of Snipe-IT versions prior to 8.6.0.\nThe flaw allows any authenticated, low-privileged user to supply arbitrary cancel_by_admin and requestingUser values directly within user-controlled URL path segments without proper server-side validation or authorization checks.\nBy successfully exploiting this security deficiency, an unauthorized user can bypass request-ownership controls to cancel pending checkout requests belonging to other users.\nBecause asset and user identifiers in Snipe-IT are implemented as sequential integers, attackers can programmatically enumerate these predictable identifiers to systematically cancel all pending checkout requests across the application.\nThe resulting impact leads to a complete disruption of the asset-request workflow, administrative oversight failures, and potential operational downtime regarding hardware or software asset allocation.\nExploitation requires authenticated access to the system with low-privileged credentials and the ability to interact with the asset checkout-request cancellation endpoint via crafted HTTP requests containing manipulated URL parameters.",
  "technicalDetails": "The vulnerability resides in the asset checkout-request cancellation endpoint of Snipe-IT, specifically affecting versions prior to 8.6.0.\nThe root cause of the vulnerability is the absence of robust server-side authorization checks verifying whether the requesting user actually owns or possesses administrative privileges over the targeted checkout request.\nThe application reads the cancel_by_admin and requestingUser values directly from user-controlled URL path segments without validating the session context against the requested resource ownership.\nBecause asset identifiers and user identifiers are generated as sequential integers, an attacker can easily predict and iterate through valid ID ranges.\nThe attack flow proceeds as follows: First, an authenticated attacker with low privileges identifies the target asset checkout-request endpoint. Second, the attacker crafts an HTTP request modifying the URL path segments to include arbitrary or sequentially enumerated values for the cancel_by_admin and requestingUser parameters. Third, the application processes the request without validating authorization, accepting the supplied input as valid.\nAs a payload behavior, supplying a non-empty cancel_by_admin value forces the application to bypass the request-ownership verification logic entirely.\nThe post-exploitation impact includes the mass cancellation of pending asset requests, leading to severe denial of service against the asset-request workflow and administrative interference.\nThe vulnerability requires low-privileged authentication, network exposure to the Snipe-IT web application, and exploits application logic flaws rather than memory corruption vectors."
}