CVE-2026-55694
Received Received - Intake

Information Disclosure in Snipe-IT

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-55694
EUVD
EUVD-2026-62631

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snipe-it snipe-it 8.6.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Snipe-IT before version 8.6.3 allows a restricted user to access another user's EULA file through a combination of information disclosure and IDOR. The attacker first requests a target user's EULA filename via an API endpoint and then downloads the file using a profile route that fails to enforce proper authorization checks.

Detection Guidance

Check Snipe-IT logs for unauthorized access attempts to /api/v1/users/{target_id}/eulas or /account/stored-eula-file/{filename}. Monitor for repeated requests to these endpoints from restricted users. Use network traffic analysis to detect unusual downloads of EULA files not belonging to the requesting user.

Impact Analysis

If you use Snipe-IT versions before 8.6.3, an attacker with restricted access could steal your EULA files, which may contain sensitive or confidential information. This could lead to privacy breaches or unauthorized access to user data.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing personal or sensitive data through unauthorized access to EULA files. Compliance requires protecting user data, and this flaw undermines those safeguards.

Mitigation Strategies

Upgrade Snipe-IT to version 8.6.3 or later immediately. Review and restrict access to API endpoints /api/v1/users/{target_id}/eulas and /account/stored-eula-file/{filename}. Audit all EULA file downloads for unauthorized access in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart