Is CVE-2026-55519 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55519 being exploited in the wild.

How severe is CVE-2026-55519?

Medium severity, with a CVSS score of 5.4, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) <= 8.4.0, ECOSYSTEM:introduced=0,fixed=8.4.1.

Is there a fix for CVE-2026-55519?

Yes. snipe/snipe-it (Packagist): upgrade to 8.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55519 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55519?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55519: Grokability Snipe-IT IDOR in file deletion endpoint

Q: Is there a fix for CVE-2026-55519?

Yes. snipe/snipe-it (Packagist): upgrade to 8.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55519 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55519?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55519 · Severity: medium · CVSS 5.4 · Published 2026-08-19

Snipe-IT, an open-source IT asset management system, contains a flaw that allows users with basic asset editing permissions to delete files attached to any asset in the system. This means an employee could potentially delete important documentation or records belonging to other departments or the entire company. This unauthorized data deletion can disrupt operations and lead to the loss of critical asset information.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-55519 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55519 being exploited in the wild.
How severe is CVE-2026-55519?: Medium severity, with a CVSS score of 5.4, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) <= 8.4.0, ECOSYSTEM:introduced=0,fixed=8.4.1.
Is there a fix for CVE-2026-55519?: Yes. snipe/snipe-it (Packagist): upgrade to 8.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55519 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55519?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.4.1 or later
```
composer require snipe/snipe-it:^8.4.1
```

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Snipe-IT v8.4.0 and earlier due to improper authorization checks in the file deletion endpoint. The application performs a class-level authorization check (verifying if a user has general 'edit asset' permissions) rather than an instance-level check (verifying if the user has permission for the specific asset or company assignment). This flaw is present in both the web and API controllers. An authenticated attacker with generic asset edit permissions can exploit this to delete arbitrary file attachments across the entire installation. The issue is addressed in version 8.4.1.

Affected products

Grokability Snipe-IT <= 8.4.0

Identifiers

CVE-2026-55519
GHSA-x667-r589-43m7

Timeline

2026-06-13: patched: Fix committed to repository
2026-06-23: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.