{"id":"CVE-2026-55519","title":"Snipe-IT is an IT asset/license management system","summary":"Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-285"],"vendor":"snipeitapp","product":"snipe-it","affected":["snipe-it < 8.4.1"],"patched":["snipe-it 8.4.1"],"published":"2026-08-19","updated":"2026-09-30","sourceUpdated":"2026-09-30T12:58:58.450","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55519","references":[{"url":"https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-x667-r589-43m7"}],"tags":["nvd","ghsa","composer"],"epss":0.00368,"epssPercentile":0.30436,"ecosystem":"composer","ingestedAt":"2026-06-26T16:43:14.577Z","slug":"CVE-2026-55519","body":"## Overview\n\nSnipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.\n\n## Affected\n\n- `snipe-it < 8.4.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snipe-it 8.4.1`\n\n## Package advisory (CVE-2026-55519)\n\nAffected packages:\n\n- `snipe/snipe-it <= 8.4.0`\n\nPatched in:\n\n- `snipe/snipe-it 8.4.1`\n\nSource: https://github.com/advisories/GHSA-x667-r589-43m7","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201781,"id":"CVE-2026-55519","ts":1789399707410,"field":"cvss","old":null,"new":"5.4"},{"seq":201780,"id":"CVE-2026-55519","ts":1789399707410,"field":"severity","old":"low","new":"medium"},{"seq":200511,"id":"CVE-2026-55519","ts":1789397363059,"field":"cvss","old":"5.4","new":null},{"seq":200510,"id":"CVE-2026-55519","ts":1789397363059,"field":"severity","old":"medium","new":"low"},{"seq":198428,"id":"CVE-2026-55519","ts":1789391951037,"field":"cvss","old":null,"new":"5.4"},{"seq":198427,"id":"CVE-2026-55519","ts":1789391951037,"field":"severity","old":"low","new":"medium"},{"seq":196221,"id":"CVE-2026-55519","ts":1789383565368,"field":"cvss","old":"5.4","new":null},{"seq":196220,"id":"CVE-2026-55519","ts":1789383565368,"field":"severity","old":"medium","new":"low"},{"seq":195150,"id":"CVE-2026-55519","ts":1789380463150,"field":"cvss","old":null,"new":"5.4"},{"seq":195149,"id":"CVE-2026-55519","ts":1789380463150,"field":"severity","old":"low","new":"medium"},{"seq":193937,"id":"CVE-2026-55519","ts":1789378490921,"field":"cvss","old":"5.4","new":null},{"seq":193936,"id":"CVE-2026-55519","ts":1789378490921,"field":"severity","old":"medium","new":"low"},{"seq":192724,"id":"CVE-2026-55519","ts":1789376395538,"field":"cvss","old":null,"new":"5.4"},{"seq":192723,"id":"CVE-2026-55519","ts":1789376395538,"field":"severity","old":"low","new":"medium"},{"seq":191511,"id":"CVE-2026-55519","ts":1789373395501,"field":"cvss","old":"5.4","new":null},{"seq":191510,"id":"CVE-2026-55519","ts":1789373395501,"field":"severity","old":"medium","new":"low"},{"seq":190296,"id":"CVE-2026-55519","ts":1789369283071,"field":"cvss","old":null,"new":"5.4"},{"seq":190295,"id":"CVE-2026-55519","ts":1789369283071,"field":"severity","old":"low","new":"medium"},{"seq":189083,"id":"CVE-2026-55519","ts":1789368253062,"field":"cvss","old":"5.4","new":null},{"seq":189082,"id":"CVE-2026-55519","ts":1789368253062,"field":"severity","old":"medium","new":"low"},{"seq":187866,"id":"CVE-2026-55519","ts":1789365139544,"field":"cvss","old":null,"new":"5.4"},{"seq":187865,"id":"CVE-2026-55519","ts":1789365139544,"field":"severity","old":"low","new":"medium"},{"seq":186653,"id":"CVE-2026-55519","ts":1789363248009,"field":"cvss","old":"5.4","new":null},{"seq":186652,"id":"CVE-2026-55519","ts":1789363248009,"field":"severity","old":"medium","new":"low"},{"seq":185439,"id":"CVE-2026-55519","ts":1789361087996,"field":"cvss","old":null,"new":"5.4"},{"seq":185438,"id":"CVE-2026-55519","ts":1789361087996,"field":"severity","old":"low","new":"medium"},{"seq":184226,"id":"CVE-2026-55519","ts":1789358133266,"field":"cvss","old":"5.4","new":null},{"seq":184225,"id":"CVE-2026-55519","ts":1789358133266,"field":"severity","old":"medium","new":"low"},{"seq":182477,"id":"CVE-2026-55519","ts":1789354212923,"field":"cvss","old":null,"new":"5.4"},{"seq":182476,"id":"CVE-2026-55519","ts":1789354212923,"field":"severity","old":"low","new":"medium"},{"seq":181270,"id":"CVE-2026-55519","ts":1789353106960,"field":"cvss","old":"5.4","new":null},{"seq":181269,"id":"CVE-2026-55519","ts":1789353106960,"field":"severity","old":"medium","new":"low"},{"seq":180063,"id":"CVE-2026-55519","ts":1789350157941,"field":"cvss","old":null,"new":"5.4"},{"seq":180062,"id":"CVE-2026-55519","ts":1789350157941,"field":"severity","old":"low","new":"medium"},{"seq":178856,"id":"CVE-2026-55519","ts":1789348074528,"field":"cvss","old":"5.4","new":null},{"seq":178855,"id":"CVE-2026-55519","ts":1789348074528,"field":"severity","old":"medium","new":"low"},{"seq":177649,"id":"CVE-2026-55519","ts":1789346269172,"field":"cvss","old":null,"new":"5.4"},{"seq":177648,"id":"CVE-2026-55519","ts":1789346269172,"field":"severity","old":"low","new":"medium"},{"seq":176442,"id":"CVE-2026-55519","ts":1789342993823,"field":"cvss","old":"5.4","new":null},{"seq":176441,"id":"CVE-2026-55519","ts":1789342993823,"field":"severity","old":"medium","new":"low"},{"seq":174559,"id":"CVE-2026-55519","ts":1789334757043,"field":"cvss","old":null,"new":"5.4"},{"seq":174558,"id":"CVE-2026-55519","ts":1789334757043,"field":"severity","old":"low","new":"medium"},{"seq":173354,"id":"CVE-2026-55519","ts":1789333483018,"field":"cvss","old":"5.4","new":null},{"seq":173353,"id":"CVE-2026-55519","ts":1789333483018,"field":"severity","old":"medium","new":"low"},{"seq":172168,"id":"CVE-2026-55519","ts":1789330992296,"field":"cvss","old":null,"new":"5.4"},{"seq":172167,"id":"CVE-2026-55519","ts":1789330992296,"field":"severity","old":"low","new":"medium"},{"seq":170982,"id":"CVE-2026-55519","ts":1789328593103,"field":"cvss","old":"5.4","new":null},{"seq":170981,"id":"CVE-2026-55519","ts":1789328593103,"field":"severity","old":"medium","new":"low"},{"seq":169777,"id":"CVE-2026-55519","ts":1789327043635,"field":"cvss","old":null,"new":"5.4"},{"seq":169776,"id":"CVE-2026-55519","ts":1789327043635,"field":"severity","old":"low","new":"medium"}]}