CVE-2026-55515

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.2

Description An authorization flaw exists in the unaccepted-assets report delete endpoint. The system only verifies the reports.view permission and executes the CheckoutAcceptance::pending()->find($acceptanceId) function using a global ID without validating access to the associated checkoutable asset. This allows a user with report access in one company to delete pending checkout acceptance records belonging to another company.

Recommendations Update to version 8.6.2.