What’s Vulnerable › Vulnerabilities

CVE-2026-55519: Snipe-IT: Improper Authorization in File Deletion (IDOR)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-30
• Weakness: CWE-285

Description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

Affected products

• grokability snipe-it: before 8.4.1 — fixed in 8.4.1

How to fix

Upgrade to a fixed version: grokability snipe-it 8.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd
• https://github.com/grokability/snipe-it/releases/tag/v8.4.1
• https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7

Get alerted when CVE-2026-55519 or the next vulnerability affects your stack