Snipe‑IT exposes a POST endpoint that accepts a cancel_by_admin URL segment. An authenticated user can supply the victim’s user ID as that segment and the request is processed without verifying that the caller has administrative privileges. This is a CWE‑862 missing authorization flaw that allows or license requests, potentially disrupting asset management workflows and causing incorrect inventory records.

The vulnerability affects all Snipe‑IT installations running a version earlier than 8.6.0. The impacted endpoint is /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?}. No specific patch level beyond 8.6.0 is mentioned as mitigated.

With a CVSS scoreSS score is indicating a low probability of exploitation and the vulnerability is not listed in CISA KEV. The attack vector is an in‑application request that can be crafted by a logged‑in user over the network; the path component must simply be supplied with a user ID. Because no additional authentication checks are performed on cancel_by_admin, the exploit requires only that the attacker be a valid authenticated user in the system.