CVE-2026-55519: medium-severity vulnerability in grokability snipe-it
Snipe-IT: Improper Authorization in File Deletion (IDOR)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.4%
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected products
grokability · snipe-itRelated CVEs — grokability snipe-it
In the same product, most dangerous first.
CVE-2026-55469MEDIUMSnipe-IT: Path traversal vulnerability via CSV import `image` fieldEPSS 0.6%CVE-2026-86733HIGHSnipe-IT before 8.7.0 Remote Code Execution via Backup RestoreEPSS 0.6%CVE-2026-86770HIGHSnipe-IT before 8.7.0 Authentication Bypass via SAML Username CollationEPSS 0.6%CVE-2026-86734HIGHSnipe-IT before 8.7.1 Denial of Service via Unbounded Note FieldEPSS 0.5%CVE-2026-55843HIGHSnipe-IT: Improper Privilege ManagementEPSS 0.5%CVE-2026-86738CRITICALSnipe-IT before 8.7.0 CSS Injection via Custom CSSEPSS 0.5%