Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-55519Snipe-IT: Improper Authorization in File Deletion (IDOR)

Medium 5.4

In plain English

A medium-severity security flaw in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 69.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	snipe/snipe-it	8.4.1	GHSA-x667-r589-43m7

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	< 8.4.1

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7 x_refsource_CONFIRM
https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd x_refsource_MISC
https://github.com/grokability/snipe-it/releases/tag/v8.4.1 x_refsource_MISC