# CVE-2026-55519: Grokability Snipe-IT IDOR in file deletion endpoint

Source: https://junglewise.ai/threats/cve-2026-55519-grokability-snipe-it-idor-in-file-deletion-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-55519 · Severity: medium · CVSS 5.4 · Published 2026-08-19

Snipe-IT, an open-source IT asset management system, contains a flaw that allows users with basic asset editing permissions to delete files attached to any asset in the system. This means an employee could potentially delete important documentation or records belonging to other departments or the entire company. This unauthorized data deletion can disrupt operations and lead to the loss of critical asset information.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it), [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-55519 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55519 being exploited in the wild.

**How severe is CVE-2026-55519?** Medium severity, with a CVSS score of 5.4, published 19 August 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) <= 8.4.0, ECOSYSTEM:introduced=0,fixed=8.4.1.

**Is there a fix for CVE-2026-55519?** Yes. snipe/snipe-it (Packagist): upgrade to 8.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55519 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55519?** Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.4.1 or later

  ```sh
  composer require snipe/snipe-it:^8.4.1
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in Snipe-IT v8.4.0 and earlier due to improper authorization checks in the file deletion endpoint. The application performs a class-level authorization check (verifying if a user has general 'edit asset' permissions) rather than an instance-level check (verifying if the user has permission for the specific asset or company assignment). This flaw is present in both the web and API controllers. An authenticated attacker with generic asset edit permissions can exploit this to delete arbitrary file attachments across the entire installation. The issue is addressed in version 8.4.1.

## Affected products

- Grokability Snipe-IT <= 8.4.0

## Identifiers

- CVE-2026-55519
- GHSA-x667-r589-43m7

## Timeline

- 2026-06-13: patched: Fix committed to repository
- 2026-06-23: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/windbreaker555](https://api.github.com/users/windbreaker555)
- [https://github.com/windbreaker555](https://github.com/windbreaker555)
- [https://api.github.com/users/windbreaker555/gists%7B/gist_id%7D](https://api.github.com/users/windbreaker555/gists%7B/gist_id%7D)
- [https://api.github.com/users/windbreaker555/repos](https://api.github.com/users/windbreaker555/repos)
- [https://avatars.githubusercontent.com/u/232655138?v=4](https://avatars.githubusercontent.com/u/232655138?v=4)
- [https://api.github.com/users/windbreaker555/events%7B/privacy%7D](https://api.github.com/users/windbreaker555/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)