CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy() methods in app/Http/Controllers/Api/UploadedFilesController.php and app/Http/Controllers/UploadedFilesController.php authorize update against the object class instead of the resolved object instance, creating an insecure direct object reference. This issue is fixed in version 8.4.1.

• CWE-285

• https://github.com/grokability/snipe-it/commit/8bc7d50e35d93eee5a0d48b4923e497937cf93fd
• https://github.com/grokability/snipe-it/releases/tag/v8.4.1
• https://github.com/grokability/snipe-it/security/advisories/GHSA-x667-r589-43m7

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55513nebula-mesh is a self-hosted control plane for Slack Nebula …5.4
• CVE-2026-55514vLLM is a library for LLM inference and serving. From 0.12.0…6.5
• CVE-2026-55515Snipe-IT is an IT asset/license management system. Prior to …5
• CVE-2026-55516Snipe-IT is an IT asset/license management system. Prior to …7.7
• CVE-2026-55517Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…4.3
• CVE-2026-55518Avo is a framework to create admin panels for Ruby on Rails …9.6
• CVE-2026-5552A weakness has been identified in PHPGurukul Online Shopping…6.3
• CVE-2026-55520Protego is a pure-Python robots.txt parser with support for …7.1
• CVE-2026-55521Yamcs is a mission control framework. Prior to 5.12.8 and 5.…8.8
• CVE-2026-55522PraisonAI is a multi-agent teams system. In versions 3.9.26 …7.8
• CVE-2026-55523PraisonAI is a multi-agent teams system. In versions 1.5.128…7.7
• CVE-2026-55524PraisonAI is a multi-agent teams system. In versions prior t…7.5