CVE-2026-55515
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view
CVSS
5.0
Medio
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Publicado: 10 jul 2026 · Última mod.: 14 jul 2026 · CWE-639
0.2%EPSS · 30 días0.3%
2026-07-112026-07-20
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.
- github.comhttps://github.com/grokability/snipe-it/commit/802067f3987a4b65bfc2efe60e22e07c24e01e6a
- github.comhttps://github.com/grokability/snipe-it/releases/tag/v8.6.2
- github.comhttps://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg
- github.comhttps://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-552558.4 ALT42.9%
KEV—63Langflow Authorization Bypass Through User-Controlled Key Vulnerability13dCVE-2021-464168.1 ALT89.9%
——27Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.8dCVE-2022-289867.5 ALT80.9%
——24LMS Doctor Simple 2 Factor Authentication Plugin For Moodle Affected: 2021072900 has an Insecure direct object references (IDOR) vulnerability, which allows remote attackers to update sensitive records such as email, password and phone number of other user accounts.12dCVE-2020-234465.3 MED65.5%
——20Verint Workforce Optimization suite 15.1 (15.1.0.37634) has Unauthenticated Information Disclosure via API12dCVE-2021-33806.5 MED61.6%
——18Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Invoice Functionality.12dCVE-2022-362029.8 CRÍ51.6%
——15Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php is affected by Broken Access Control (IDOR) via id= parameter.12d