[MEDIUM] Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

PKSA-mtr1-kyd4-dpz1 CVE-2026-55515 GHSA-35cr-9hqq-p2mg

Affected package: snipe/snipe-it

Affected version: <=8.6.1

Reported by:
GitHub