CVE-2026-55519 Snipe-IT: Improper Authorization in File Deletion (IDOR)

What is CVE-2026-55519?

CVE-2026-55519 is a medium-severity missing authorization vulnerability in Snipeitapp Snipe-It, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

Weakness: CWE-285

Which versions are affected by CVE-2026-55519?

2 open source packages ship an affected version, including snipe/snipe-it. It affects 1 product.

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-55519?

Upgrade snipe/snipe-it to 8.4.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-55519 being exploited?

There is no known exploitation of CVE-2026-55519 in the wild and no public exploit code.

Other vulnerabilities in Snipeitapp Snipe-It

• CVE-2025-63601 File upload in n/a Critical 9.9
• CVE-2026-37709 Snipe-IT has insecure permissions in file uploads Critical 9.8
• CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS Critical 9.3
• CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback Critical 9.2
• CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it Critical 9.1

All Snipeitapp Snipe-It vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x667-r589-43m7.