CVE-2026-86747 snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/unacceptedassets/sentreminder ReportsController::sentAssetAcceptanceReminder and DELETE /reports/unacceptedassets/acceptanceId/delete...

CVE-2026-55515 Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending-find$acceptanceId by global ID without checking access to the related checkoutable asset, allowing a reports user in...