CVE-2026-55519
MediumCVSS 5.4Summary
Snipe-IT prior to 8.4.1 allows an authenticated user with generic asset edit permission to delete files attached to assets outside their ownership or company. The destroy() methods authorize against the object class instead of the instance, creating an insecure direct object reference.
Risk Assessment
The risk includes deletion of important asset-related files, potentially leading to data loss and integrity issues.
Recommendation
Update to version 8.4.1 or later and implement authorization at the specific asset level.
Original NVD description (English source)
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.