Authenticated File Deletion in Snipe-IT via IDOR

Executive Summary

CVE-2026-55519 is an Improper Authorization vulnerability in Snipe-IT versions up to 8.4.0. It allows authenticated users with basic asset edit permissions to delete files attached to any asset in the system, regardless of ownership or company assignment. This happens because the file deletion endpoint checks authorization at the class level instead of the instance level.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Snipe-IT instances running versions prior to 8.4.1 for unauthorized file deletions. Review logs for suspicious activity in app/Http/Controllers/UploadedFilesController.php and app/Http/Controllers/Api/UploadedFilesController.php. Look for users with generic asset edit permissions performing deletions outside their assigned assets or company scope.

Useful 0 Not Useful 0

Impact Analysis

An attacker with basic permissions could delete important files attached to assets they do not own, potentially causing data loss or disrupting asset management. However, the impact is limited as it requires authentication and does not affect confidentiality or availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion, which may violate integrity requirements in GDPR and HIPAA. However, since it requires authentication and does not expose data, the direct compliance impact is likely minimal.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Snipe-IT to version 8.4.1 or later. If upgrading is not possible, restrict generic asset edit permissions to only necessary users and monitor file deletion activities closely. Review and audit all file attachments for unauthorized deletions.

Useful 0 Not Useful 0