Executive brief
Snipe-IT, an open-source IT asset management system, contains a flaw that allows users with basic asset editing permissions to delete files attached to any asset in the system. This means an employee could potentially delete important documentation or records belonging to other departments or the entire company. This unauthorized data deletion can disrupt operations and lead to the loss of critical asset information.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Snipe-IT v8.4.0 and earlier due to improper authorization checks in the file deletion endpoint. The application performs a class-level authorization check (verifying if a user has general 'edit asset' permissions) rather than an instance-level check (verifying if the user has permission for the specific asset or company assignment). This flaw is present in both the web and API controllers. An authenticated attacker with generic asset edit permissions can exploit this to delete arbitrary file attachments across the entire installation. The issue is addressed in version 8.4.1.
Affected products
- Grokability Snipe-IT <= 8.4.0
Timeline
- 2026-06-13: patched: Fix committed to repository
- 2026-06-23: advisory: GitHub Advisory published
References
- https://api.github.com/users/windbreaker555
- https://github.com/windbreaker555
- https://api.github.com/users/windbreaker555/gists%7B/gist_id%7D
- https://api.github.com/users/windbreaker555/repos
- https://avatars.githubusercontent.com/u/232655138?v=4
- https://api.github.com/users/windbreaker555/events%7B/privacy%7D