CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd	Patch
https://github.com/grokability/snipe-it/releases/tag/v8.4.1	Release Notes Patch
https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*

History

30 Sep 2026, 12:58

Type	Values Removed	Values Added
First Time		Snipeitapp snipe-it Snipeitapp
CPE		cpe:2.3:a:snipeitapp:snipe-it::::::::
References	~~() https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd -~~	() https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd - Patch
References	~~() https://github.com/grokability/snipe-it/releases/tag/v8.4.1 -~~	() https://github.com/grokability/snipe-it/releases/tag/v8.4.1 - Release Notes, Patch
References	~~() https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7 -~~	() https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7 - Patch, Vendor Advisory

Information

Published : 2026-08-19 19:17

Updated : 2026-09-30 12:58

NVD link : CVE-2026-55519

Mitre link : CVE-2026-55519

CVE.ORG link : CVE-2026-55519

JSON object : View

Products Affected

snipeitapp

snipe-it

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-55519", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55519", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T20:58:58.195464Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "grokability", "product": "snipe-it", "versions": [{"status": "affected", "version": "< 8.4.1"}]}]}], "published": "2026-08-19T19:17:20.263", "references": [{"url": "https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/releases/tag/v8.4.1", "tags": ["Release Notes", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1."}], "lastModified": "2026-09-30T12:58:58.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB07F5CD-5BCC-4858-8FAD-10A9DBEE5466", "versionEndExcluding": "8.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}