CVE-2026-19579

Katalog CVE

CVSS 5.4 · Medium EPSS 0,34%

Kerentanan Authorization Bypass Through User-Controlled Key pada snipeitapp snipe-it. Skor CVSS 3.1 5.4 (Medium) menurut tenable.com.

Deskripsi (NVD)

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

Rincian

Terbit di NVD

11 Agustus 2026

Terakhir diubah

21 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber tenable.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key
CWE-807: Reliance on Untrusted Inputs in a Security Decision

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tenable.com/security/research/tra-2026-54 advisory pihak ketiga · exploit
• https://github.com/snipe/snipe-it/releases/tag/v8.6.0 release notes