Popis
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
CVSS 4.3EPSS 0.2%Riziko 0.44
Zobraziť zdroj- Zverejnené
- 2026-07-10 19:17:25
- Dotknuté verzie
- <8.6.0
- Typ
- Webová aplikácia
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N