CVE-2026-19579

The CVSS 5.4 score for CVE-2026-19579 badly understates the operational risk. A single authenticated user can enumerate sequential checkout request IDs and the `cancel_by_admin` parameter to mass-cancel every pending request across the organization — this isn't targeted sabotage, it's a structural availability failure that makes the asset-request workflow fundamentally unreliable. The root cause is a design-level assumption failure, not a simple implementation bug. The code path trusts client-supplied `cancel_by_admin` and `requestingUser` values as authorization signals rather than treating them as untrusted input requiring server-side validation. Someone reasoned: "if this flag is set, the caller is an admin" — a category error where a convenience flag became a privilege check. This pattern has appeared repeatedly across codebases because it's written last under shipping pressure, then never revisited. The vulnerability rewards low-effort, high-repetition exploitation. Unlike a data breach where attackers want to be quiet, mass cancellations force organizational workarounds — screenshot-based tracking, verbal handoffs, shadow spreadsheets. Each workaround creates its own data integrity holes. The audit trail corruption is the real blast radius: every SOC 2 control, every compliance report, every legal review relying on asset custody records becomes unreliable. Verify whether version 8.6.0 implements proper role-based authorization checks at the endpoint level or merely sanitizes parameter inputs. If the `cancel_by_admin` flag persists in the code path (even with constrained values), the vulnerability can be reintroduced through parameter pollution, type coercion, or future development. Review other endpoints for the same anti-pattern — client-supplied metadata trusted as authorization signals is likely present elsewhere in the codebase. Prioritize patching this CVE. Organizations running Snipe-IT for physical assets (equipment, access credentials) face immediate operational impact if the vulnerability is exploited repeatedly.

Reviewed through automated stages and approved by a human before publication.