CVE-2026-55519

Published: Aug 19, 2026Modified: Aug 21, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.8 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

Related CWEs

CWE-285

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd

Source: security-advisories@github.com

https://github.com/grokability/snipe-it/releases/tag/v8.4.1

Source: security-advisories@github.com

https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7

Source: security-advisories@github.com

Timeline

No history available yet.