CVE-2026-19579

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Snipe-IT via IDOR

Publication date: 2026-08-11

Last updated on: 2026-08-21

Assigner: Tenable Network Security, Inc.

Description

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-21

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-19579

EUVD

EUVD-2026-56949

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Attack-Flow Graph

Executive Summary

Snipe-IT before version 8.6.0 has an authorization bypass vulnerability in the asset checkout-request cancellation feature. The issue occurs because the application reads user-controlled values from URL path segments without performing a server-side authorization check. This allows any authenticated low-privileged user to manipulate these values to cancel another user's pending checkout request.

Detection Guidance

To detect this vulnerability, check if your Snipe-IT instance is running a version before 8.6.0. Verify by running: curl -s http://your-snipe-it-url/ | grep -i version. If the version is below 8.6.0, the system is vulnerable. Test by attempting to cancel another user's checkout request via the URL path manipulation described in the vulnerability details.

Impact Analysis

An attacker could exploit this to cancel pending asset checkout requests, disrupting workflows. Since asset and user IDs are sequential integers, an attacker can enumerate them to cancel all pending requests. This could prevent legitimate users from accessing needed assets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it involves an authorization bypass in an asset management system rather than data breaches or unauthorized access to sensitive information. However, if the affected system processes or stores personal data, the disruption of asset workflows could indirectly impact operational compliance.

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.0 or later to address the authorization bypass vulnerability in the asset checkout-request cancellation endpoint.

Hi! I’m here to help you understand CVE-2026-19579. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70