Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes CheckoutAcceptance::pending()->find($acceptanceId) by global ID without checking access to the related checkoutable asset, allowing a reports user in one company to delete pending checkout acceptance records for another company. This issue is fixed in version 8.6.2.

Affected: Packagist: snipe/snipe-it

### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.

The report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()->find($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset.

### Preconditions The attacker needs: - A valid authenticated web session. - `reports.view` permission. - Knowledge or guessability of a pending `checkout_acceptances.id`.

The attacker does not need access to the asset/company associated with the target acceptance.

### Root cause The delete action authorizes only report access, then deletes a pending acceptance by global ID:

```php

$this->authorize('reports.view');

$acceptance = CheckoutAcceptance::pending()->find($acceptanceId);

$acceptance->delete(); ```

The code does not check whether the current user can access the acceptance’s related checkoutable asset/accessory/license/etc. In multi-company mode, this allows a reports user from one company to delete acceptance records belonging to another company.

### Proof of concept #### Target acceptance belongs to Company B

The target pending acceptance was identified as id=1.

```sql snipe_sql "SELECT ca.id ca.checkoutable_id, ca.deleted_at, a.asset_tag, a.company_id FROM checkout_acceptances ca JOIN assets a ON a.id = ca.checkoutabl…