Snipe‑IT before version 8.6.0 contains an insecure direct object reference that allows any authenticated user with low privileges to cancel another user’s pending checkout request. The cancel_by_admin and requestingUser values are taken from URL path segments without a server‑side authorization check, enabling the attacker to bypass the ownership check. This flaw can lead to unauthorized cancellation of assets and disruption of the asset‑request workflow, as the attackers can enumerate sequential asset identifiers.

The affected product is Snipe‑IT provided by Grokability. All installations running a version earlier than 8.6.0 are vulnerable. The specific version impacted is any release before 8.6.0, with the fix delivered in the 8.6.0 release announced on GitHub.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. However, because asset and user identifiers are sequential integers, an attacker can enumerate them and cancel many pending requests, disrupting workflow. The likely attack vector is an HTTP request to the cancellation endpoint with manipulated path parameters by an authenticated, low‑privileged user.