CVE-2026-55694

MediumCVSS 6.5/10Last modified Sep 30, 2026

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
grokability	snipe-it	< 8.6.3

References

https://github.com/grokability/snipe-it/commit/f15d78621b003be30ac114ba68626683894935efPatch
https://github.com/grokability/snipe-it/releases/tag/v8.6.3Release Notes, Patch
https://github.com/grokability/snipe-it/security/advisories/GHSA-3hgv-jr5j-cg9xExploit, Patch, Vendor Advisory
https://github.com/grokability/snipe-it/security/advisories/GHSA-3hgv-jr5j-cg9xExploit, Patch, Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-556959.1FearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated adminis CVE-2026-556964.3PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/pr CVE-2026-556978.8pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command d CVE-2026-556988.8pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pn CVE-2026-556996.5pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. Whe CVE-2026-55709.8A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the fil CVE-2026-557007.1pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name an CVE-2026-557016.9The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver val CVE-2026-557034.3Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance CVE-2026-557044.3Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’CVE-2026-557068.3sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.CVE-2026-557077.1In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can