Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cancel_by_admin as a URL path segment without sufficient authorization, allowing an authenticated user to supply a victim user ID and silently cancel that user’s pending asset requests. This issue is fixed in version 8.6.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
grokability snipe-it
< 8.6.0affected
References
- https://github.com/grokability/snipe-it/security/advisories/GHSA-53jc-27pc-x8r8 ↗
- https://github.com/grokability/snipe-it/commit/3c1b18919afbba12d419a9795929493b0391c91a ↗
- https://github.com/grokability/snipe-it/commit/ac2162113d9e25e4c61b61916ce67fb2a1050553 ↗
- https://github.com/grokability/snipe-it/releases/tag/v8.6.0 ↗