Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter

中 4.3CVE-2026-55476 · GHSA-53jc-27pc-x8r8 · 10/07/2026 公開 · 25/10/2026 更新

要点

CVE-2026-55476 は snipe/snipe-it, snipe-it (snipeitapp) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.34%（全脆弱性の 27.0% より高い）。
対処：8.6.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
snipe/snipe-it Packagist	`< 8.6.0`	`8.6.0`
snipe-it snipeitapp	`< 8.6.0`	`8.6.0`

概要

Impact

The route POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a plain URL path segment with no authorization check. Any authenticated user regardless of permissions can set this parameter to a truthy value and supply a victim's user ID to silently cancel that user's pending asset requests. The attacker only needs an active session; no elevated privilege is required.

Patches

Patched in 8.6.1

NVD の説明

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.