CVE-2026-55515 is an authorization bypass vulnerability in the Snipe-IT IT asset management system before version 8.6.2. The unaccepted-assets report delete endpoint authorizes only the reports.view permission and deletes CheckoutAcceptance::pending()->find($acceptanceId) records by global ID without checking if the user has access to the related checkoutable asset. This allows a reports user from one company to delete pending checkout acceptance records of another company, violating proper access controls. The vulnerability is addressed in Snipe-IT version 8.6.2.

An attacker with reports.view privileges in one company can delete pending checkout acceptance records belonging to other companies, potentially disrupting asset management processes. The vulnerability does not impact confidentiality or availability but allows unauthorized modification (deletion) of data, which may affect integrity within multi-tenant environments.

Upgrade Snipe-IT to version 8.6.2 or later, where this authorization bypass issue is fixed. No other mitigation or workaround is documented. Patch status is confirmed fixed in 8.6.2.