Every CVE Search/ Get API key

CVE-2026-55694

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

7.1 HighFix available

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.29%Up 0.1 points since Aug 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Record
CVE-2026-55694
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
EUVDEUVD-2026-62631 7.1

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Record
EUVD-2026-62631
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3hgv-jr5j-cg9x 7.1

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Impact

An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.

Steps to Reproduce:

  1. Log in as a restricted user.
  2. Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).
  3. Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).
  4. Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).
  5. Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.
  6. Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.

Patches

Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef

Record
GHSA-3hgv-jr5j-cg9x
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
NVD 7.1

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Record
CVE-2026-55694
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-639
Updated
2026-11-02
OSV 7.1

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Record
CVE-2026-55694
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
OSVGHSA-3hgv-jr5j-cg9x 7.1

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Impact

An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.

Steps to Reproduce:

  1. Log in as a restricted user.
  2. Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).
  3. Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).
  4. Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).
  5. Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.
  6. Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.

Patches

Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef

Record
GHSA-3hgv-jr5j-cg9x
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
snipe/snipe-it
Packagist
 before 8.6.3
8.6.3
snipe/snipe-it
Packagist
 before 8.6.3, plus listed versions
3.2.0v0.1.0v0.1.1v0.1.2v0.2.0
Show 45 moreShow less
v0.3.0-alphav0.3.10-alphav0.3.11-alphav0.3.7-alphav0.3.8-alphav0.3.9-alphav1.0v1.1v1.2.0v1.2.1v1.2.10v1.2.11v1.2.2v1.2.3v1.2.3-betav1.2.4v1.2.4-betav1.2.5v1.2.6v1.2.6-betav1.2.6.1v1.2.7v1.2.7-betav1.2.8v1.2.9v2.0v2.0-RC-1v2.0-betav2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.2v3.0v3.0-alphav3.0-alpha2v3.0-beta.1v3.0-beta.2v3.0-beta.3v3.0.0-betav3.1.0
8.6.3

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55694 is a high vulnerability (CVSS 7.1) in Grokability Snipe-it, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in snipe/snipe-it 8.6.3.

References

This page doesn't list everything

Left out here: 229 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open