CVE-2026-55519Medium· 5.4▾ SunlitSnipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
5.4 → —
medium → low
— → 5.4
low → medium
5.4 → —
medium → low
— → 5.4
low → medium
5.4 → —
medium → low
— → 5.4
low → medium
0.2% → 0.4%
Last analysed / modified upstream
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.
snipe-it < 8.4.1Upgrade past the affected range:
snipe-it 8.4.1Affected packages:
snipe/snipe-it <= 8.4.0Patched in:
snipe/snipe-it 8.4.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55482Medium· 6.3Snipe-IT is an IT asset/license management system
CVE-2026-116199High· 8.1Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback
CVE-2026-63498High· 8.7Snipe-IT is an IT asset/license management system
CVE-2026-62368High· 8.1Snipe-IT is an IT asset/license management system
CVE-2026-63493High· 8.1Snipe-IT is an IT asset/license management system
CVE-2026-55694Medium· 6.5Snipe-IT is an IT asset/license management system