[GHSA] GHSA-35cr-9hqq-p2mg (medium) — Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

GHSA-35cr-9hqq-p2mg Severity: medium CVE: CVE-2026-55515

Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint

### Impact A user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.

The report listing page appears to scope visible unaccepted assets,