CVE-2026-55694: Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover
Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.
Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/{targetid}/eulas (where targetid belongs to a restricted/denied user). 3. Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf). 4. Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden). 5. Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}. 6. Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.
Patches Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef
Other sources
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{targetid}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.3 - Upgrade
Upgrade
grokability/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.3Patch f15d78621b003be30ac114ba68626683894935ef
Event History
Frequently Asked Questions
Who can exploit this issue?
A restricted Snipe-IT user can exploit it. The user must be able to request the affected API endpoint for another user's ID and then access the account stored-EULA-file route using the disclosed filename.
What information can an attacker access?
The issue can expose another user's randomized EULA filename and allow download of that user's signed EULA file. The affected access path is /api/v1/users/{target_id}/eulas followed by /account/stored-eula-file/{filename}.
Are deployments running version 8.6.3 affected?
No. The issue is fixed in Snipe-IT version 8.6.3; versions prior to 8.6.3 are affected.