CVE-2026-19579

creationtimestamp| type| source ---|---|--- 2026-08-12 15:58:29+00:00| seen| https://infosec.exchange/users/AAKL/statuses/117083361056333185...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...