CVE-2026-109562: SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated SnapOtter principal can exploit the affected handlers, including an API key limited to the settings:read scope. No higher file-upload or preview permission is required.
What endpoints and capabilities are exposed?
The affected endpoints are /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate. An attacker can stage arbitrary files outside the storage quota and submit crafted content to image and video decoders.
Can uploaded files be accessed without authentication?
Yes. Files staged through the vulnerable flow can be served unauthenticated through /api/v1/download.
Which versions are affected?
SnapOtter versions 1.15.10 through 2.2.0 are affected.