Insecure Direct Object Reference in Snipe-IT IT Asset Management System
CVE-2026-55519

5.4MEDIUM

Key Information:

Vendor: Grokability
Status: Snipe-it
Vendor: CVE Published:; 19 August 2026

🔔 Create Grokability Vulnerability Alert

What is CVE-2026-55519?

Snipe-IT, an IT asset and license management system, exhibits a vulnerability that allows an authenticated user with generic asset edit permissions to delete files attached to assets that are not owned or assigned to them. The flaw stems from the destroy() methods in specific controller files that incorrectly authorize actions against the class rather than the resolved instance, leading to an insecure direct object reference. This security issue has been addressed and resolved in version 8.4.1.