CVE-2026-55519 json
Snipe-IT: Improper Authorization in File Deletion (IDOR)
published 2026-06-23 4 mo ago modified 2026-09-30 40 d ago also EUVD-2026-62681 , GHSA-x667-r589-43m7
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.
Patch / fix
- packagist snipe/snipe-it 8.4.1
- snipeitapp snipe-it 8.4.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 0.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | snipe/snipe-it | <8.4.1 |
8.4.1 |
Affected products
- grokability snipe-it
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd
web, patch
-
github.com
/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7
web, patch, vendor-advisory
-
github.com
/grokability/snipe-it/releases/tag/v8.4.1
release-notes, patch
-
github.com
/grokability/snipe-it
package
Sources
- CVE List CVE-2026-55519
- GitHub Advisory GHSA-x667-r589-43m7
- NVD CVE-2026-55519
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.