Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19579

CVE-2026-19579MEDIUM

Grokability Snipe-IT — Snipe-IT Checkout Request Cancellation IDOR

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   L   N   N   L   L    5.3   .0034   25.3     —

AFFECTED
  Product   Versions     Fixed
  Snipe-IT  unspecified  —

TIMELINE
  Aug 11  Reserved by tenable
  Aug 11  Published (CNA: tenable)
  Aug 21  EXPLOIT PUBLISHED — CVE-2026-19579 (Grokability Snipe-IT). Public exploit reference added.

CWE-639, CWE-807 · CNA: tenable · CVSS v4.0 · 2 references · NVD status: Analyzed

Description

Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_admin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any authenticated, low-privileged user can supply a non-empty cancel_by_admin value to bypass the request-ownership check and cancel another user's pending checkout request. Because asset and user identifiers are sequential integers, an attacker can enumerate them to cancel every pending checkout request, disrupting the asset-request workflow. This is fixed in Snipe-IT 8.6.0.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 11, 2026	Reserved	Reserved by tenable
August 11, 2026	Published	Published (CNA: tenable)
August 21, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-19579 (Grokability Snipe-IT). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Grokability	Snipe-IT	—	—	—

Weaknesses

CWE-639 · CWE-807

References (2)

https://github.com/snipe/snipe-it/releases/tag/v8.6.0 [Release Notes]
https://www.tenable.com/security/research/tra-2026-54 [Third Party Advisory, Exploit]

Authoritative record: CVE-2026-19579 at cve.org

Vendors: grokability

Weaknesses: CWE-639 · CWE-807

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19579 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.