CVE-2026-109562

Received Received - Intake

Missing Authorization in SnapOtter Allows File Upload Abuse

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109562

Affected Vendors & Products

Vendor	Product	Version / Range
snapotter-hq	SnapOtter	1.15.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

SnapOtter versions 1.15.10 through 2.2.0 have a missing authorization vulnerability. This flaw allows any authenticated user, even with limited permissions like a settings:read-scoped API key, to access handlers such as /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate without proper permission checks.

Detection Guidance

Check SnapOtter API endpoints for unauthorized access attempts to /api/v1/upload, /api/v1/preview, or /api/v1/preview/generate. Monitor logs for unusual file uploads or downloads via /api/v1/download. Verify if authenticated principals with settings:read-scoped API keys are accessing restricted handlers.

Impact Analysis

Attackers can exploit this to upload arbitrary files beyond storage limits. These files can then be served without authentication via /api/v1/download. Additionally, crafted input could be fed to image and video decoders, potentially leading to further system compromise or unauthorized access.

Compliance Impact

The vulnerability allows unauthorized file uploads and access, which could lead to exposure of sensitive data. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade SnapOtter to a version beyond 2.2.0 where the vulnerability is patched. Restrict API key permissions to prevent settings:read-scoped access. Implement strict access controls for /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate endpoints. Review and remove unauthorized file uploads from storage.

Hi! I’m here to help you understand CVE-2026-109562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70