Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

• <= 8.6.1

### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset. ### Preconditions The attacker needs: - A valid authenticated web session. - `reports.view` permission. - Knowledge or guessability of a pending `checkout_acceptances.id`. The attacker does not need access to the asset/company associated with the target acceptance. ### Root cause The delete action authorizes only report access, then deletes a pending acceptance by global ID: ```php $this->authorize('reports.view'); $acceptance = CheckoutAcceptance::pending()->find($acceptanceId); $acceptance->delete(); ``` The code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc. In multi-company mode, this allows a reports user from one company to delete acceptance records belonging to

GitHub Advisory Database

• ECOSYSTEM: introduced 0; fixed 8.6.2

### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company. The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset. ### Preconditions The attacker needs: - A valid authenticated web session. - `reports.view` permission. - Knowledge or guessability of a pending `checkout_acceptances.id`. The attacker does not need access to the asset/company associated with the target acceptance. ### Root cause The delete action authorizes only report access, then deletes a pending acceptance by global ID: ```php $this->authorize('reports.view'); $acceptance = CheckoutAcceptance::pending()->find($acceptanceId); $acceptance->delete(); ``` The code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc. In multi-company mode, this allows a reports user from one company to delete acceptance records belonging to

GitHub Advisory Database via OSV