The vulnerability exploits a POST API endpoint that accepts a cancel_by_admin URL path segment without validating the caller’s privileges. An authenticated user can insert the victim’s user ID into this segment and silently cancel that user’s pending asset requests. This behavior satisfies the definition of a missing authorization flaw (CWE‑862), compromising the integrity of asset management records and potentially disrupting workflow consistency.

All installations of Snipe‑IT running a version earlier than 8.6.0 are affected, as the vulnerable POST route resides in those releases. The impacted endpoint follows the pattern /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}. No additional product or vendor scope is listed.

The CVSS base score of 5.3 denotes a medium severity condition. EPSS indicates that the probability of exploitation is very low (under 1%). The vulnerability is not listed in the CISA KEV catalog. Attack requires only that the adversary authenticate to the system and construct a valid in‑application HTTP request to the /account/request/* route with a victim user ID as a path component. No elevated privileges or external exposure are necessary beyond legitimate user access.