GHSA-3hgv-jr5j-cg9x CVE-2026-55694
Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.29%
- Chance of exploitation in the next 30 days. Higher than 21.45% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-639 Authorization Bypass Through User-Controlled Key
- Fix
8.6.3- Upgrade snipe/snipe-it to this version or later
Description
Impact
An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.
Steps to Reproduce:
- Log in as a restricted user.
- Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).
- Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).
- Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).
- Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.
- Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.
Patches
Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| snipe/snipe-it | < 8.6.3 |
8.6.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
snipe/snipe-it Packagist → 8.6.3
- composer
composer require snipe/snipe-it:^8.6.3
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-639: Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
How to prevent it
- Architecture and Design: For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- Architecture and Design, Implementation: Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
- Architecture and Design: Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-396x-xmvh-p563 Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | Medium | Also affects snipe/snipe-it |
| GHSA-p9h3-gvpq-5539 Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | High | Also affects snipe/snipe-it |
| GHSA-hxcx-9h4f-42xx Snipe-IT: 2FA bypass via the API token flow | High | Also affects snipe/snipe-it |
| GHSA-c8qc-wf67-342w Snipe-IT: Stored DOM XSS via table selected-count IDs | Medium | Also affects snipe/snipe-it |
| GHSA-r9r3-g9fp-3q4q Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET | Medium | Also affects snipe/snipe-it |
| GHSA-c6w2-j4wq-mvwg Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode | High | Also affects snipe/snipe-it |
| GHSA-35cr-9hqq-p2mg Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint | Medium | Also affects snipe/snipe-it |
| GHSA-w7qw-5wfv-gwx9 Snipe-IT has CSS Injection via `header_color` Setting | Medium | Also affects snipe/snipe-it |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor