What’s Vulnerable › Vulnerabilities

CVE-2026-19579: Snipe-IT Checkout Request Cancellation IDOR

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-11 · updated 2026-10-23
• Weakness: CWE-639

Description

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

Affected products

• grokability snipe-it: before 8.6.0 — fixed in 8.6.0

How to fix

Upgrade to a fixed version: grokability snipe-it 8.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/snipe/snipe-it/releases/tag/v8.6.0
• https://www.tenable.com/security/research/tra-2026-54

Get alerted when CVE-2026-19579 or the next vulnerability affects your stack