Sign in
Deutsch English Español Polski
High

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

  • Disclosed: 19.08.2026
  • Updated: 11.10.2026 10:22

Impact

An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application.

Steps to Reproduce:

  1. Log in as a restricted user.
  2. Send a GET request to /api/v1/users/{target_id}/eulas (where target_id belongs to a restricted/denied user).
  3. Observe the response leaks the secret EULA filename (e.g., eula-xxx.pdf).
  4. Attempt to access this file via the main route: GET /stored-eula-file/{filename} (This will correctly return 403 Forbidden).
  5. Now, access the file via the vulnerable profile route: GET /account/stored-eula-file/{filename}.
  6. Observe that the server returns a 200 OK and successfully downloads the target user's secret EULA file.

Patches

Fixed in https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935ef

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package snipe/snipe-it < 8.6.3 8.6.3

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-639
Platform
Composer
Package
snipe/snipe-it
Disclosed
19.08.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-3hgv-jr5j-cg9x - CC BY 4.0

Vulnerability history: snipe/snipe-it

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (81) in the archive
Total entries
81
First → latest
10.2021 09.2026
Without a fix
6
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 23
  • Medium 53
  • Low 4

Disclosures per year

Severity:
  1. Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
    High · 8.7 CVE-2026-63498 < 8.7.0 8.7.0
  2. Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
    High · 8.1 CVE-2026-62368 < 8.7.0 8.7.0
  3. Snipe-IT: 2FA bypass via the API token flow
    High CVE-2026-63493 < 8.7.0 8.7.0
  4. Snipe-IT has an Improper Privilege Management issue
    High · 6.5 CVE-2026-55843 < 8.6.0 8.6.0
  5. Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update
    High · 7.7 CVE-2026-55516 < 8.6.2 8.6.2
  6. Snipe-IT vulnerable to directory traversal in displaySig
    High CVE-2026-55474 < 8.5.0 8.5.0
  7. Snipe-IT has an authorization bypass on bulk editing users
    High · 7.1 CVE-2026-55460 < 8.6.2 8.6.2
  8. Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover this entry
    High CVE-2026-55694 < 8.6.3 8.6.3
  9. Snipe-IT: Tenant Isolation Bypass in FMCS Floater Mode
    High CVE-2026-55643 < 8.6.3 8.6.3
  10. Snipe-IT API Vulnerable to Cross-Tenant Accessory Injection
    High · 8.5 CVE-2026-54329 < 8.6.2 8.6.2
  11. Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
    High · 7.1 CVE-2026-48507 < 8.6.0 8.6.0
  12. Snipe-IT has insecure permissions in file uploads
    Critical · 9.8 CVE-2026-37709 < 8.4.1 8.4.1
  13. Snipe-IT has Privilege Escalation via API Permissions Assignment
    High · 8.8 CVE-2026-44832 < 8.4.1 8.4.1
  14. Snipe-IT has sensitive user attributes related to account privileges that are insufficiently protected against mass assignment
    High · 8.8 CVE-2025-15602 < 8.3.7 8.3.7
  15. Cross Site Scripting vulnerability in Snipe-IT
    High · 8.7 CVE-2024-51093 <= 7.0.13 no fix
  16. Snipe-IT remote code execution
    High · 7.2 CVE-2024-48987 < 7.0.10 7.0.10
  17. Snipe-IT allows users to promote or demote themselves or other users
    High · 8.1 CVE-2024-5685 < 6.4.2 6.4.2
  18. Cross-Site Request Forgery (CSRF) in snipe/snipe-it
    High · 8.8 CVE-2023-5511 < 6.2.3 6.2.3
  19. snipe-IT vulnerable to host header injection
    High · 8.8 CVE-2022-23064 >= 3.0-alpha, < 5.3.8 5.3.8
  20. Old sessions not blocked by login enable function in Snipe-IT
    High · 7.4 CVE-2022-1155 >= 6.0.0-RC-1, < 6.0.0-RC-6, < 5.4.2 6.0.0-RC-6, 5.4.2
  21. Improper Privilege Management in Snipe-IT
    High · 8.8 CVE-2022-0611 < 5.3.11 5.3.11
  22. snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
    High · 8.8 CVE-2021-4130 < 5.3.6 5.3.6
  23. Server-Side Request Forgery in snipe/snipe-it
    High · 7.2 CVE-2021-4075 < 6.0.0-GM 6.0.0-GM
  24. Cross-site Scripting in snipe/snipe-it
    High · 8.0 CVE-2021-3961 < 5.3.2 5.3.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.