CVE-2026-55476 is a missing authorization vulnerability (CWE-862) in the grokability Snipe-IT IT asset/license management system. Specifically, in versions before 8.6.0, the POST endpoint /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} improperly accepts the cancel_by_admin parameter as a URL path segment without sufficient authorization checks. This allows an authenticated user to cancel pending asset requests of other users by supplying their user ID, bypassing intended access controls. The vulnerability is resolved in Snipe-IT version 8.6.0.

An authenticated user with low privileges can cancel pending asset requests of other users without authorization. This could disrupt asset management workflows and potentially cause administrative confusion or denial of legitimate asset requests. There is no indication of privilege escalation, data disclosure, or remote code execution. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low privileges required, and low impact on integrity.

Upgrade Snipe-IT to version 8.6.0 or later, where this authorization issue is fixed. Since the vendor advisory or patch links are not explicitly provided, confirm the upgrade from official Snipe-IT release notes or vendor advisories. No other mitigation or workaround is specified.