Is there a patch available for CVE-2026-55542?

Yes, a patch is available for CVE-2026-55542. Update the affected software to the latest version immediately.

Snipe-IT CVE-2026-55542

Q: What is the CVSS score of CVE-2026-55542?

CVE-2026-55542 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-42398 LOW

Missing Authorization (CWE-862)

2026-06-23 https://github.com/grokability/snipe-it

GHSA-6mmj-jhqj-6c6q

PHP Authentication Bypass

1.3

CVSS 4.0 · Vendor: https://github.com/grokability/snipe-it

Severity by source

Vendor (https://github.com/grokability/snipe-it) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable web endpoint (AV:N), low complexity once filename is known (AC:L), requires authenticated session (PR:L), confidentiality-only impact limited to signature images (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/grokability/snipe-it).

CVSS VectorVendor: https://github.com/grokability/snipe-it

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 08, 2026 - 21:22 NVD

1.3 (LOW)

Source Code Evidence Fetched

Jun 23, 2026 - 23:53 vuln.today

Analysis Generated

Jun 23, 2026 - 23:53 vuln.today

DescriptionCVE.org

Impact

Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.

On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch.

Key evidence

routes/web.php:135-143; app/Http/Controllers/ActionlogController.php:16-44; app/Http/Controllers/Account/AcceptanceController.php:160,175; app/Listeners/LogListener.php:56; app/Http/Transformers/ActionlogsTransformer.php:188

Patches

Patched in https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259

Credit

Disclosed by Ikaro tiagonas

AnalysisAI

Signature image retrieval in Snipe-IT's S3-backed deployments bypasses authorization, allowing any authenticated user to obtain a 5-minute pre-signed S3 URL for acceptance signature images they are not permitted to view. The flaw exists in ActionlogController.php where the S3 code path returns a signed URL before the authorize() call is reached - a call that is correctly enforced only in the local-file code path. Affected are all Snipe-IT deployments on versions <= 8.5.0 configured to use S3 storage; no public exploit code exists and this CVE is not listed in CISA KEV.

Technical ContextAI

Snipe-IT is an open-source PHP/Laravel IT asset management application (composer package snipe/snipe-it). The affected code lives in app/Http/Controllers/ActionlogController.php in the displaySig() method, routed via routes/web.php:135-143. When storage is backed by Amazon S3 (or compatible), the method generates a time-limited pre-signed URL. However, the authorization gate ($this->authorize('view', ...)) was placed after the S3 branch's early return, meaning the S3 path never executed the gate. The local-file branch did call authorize(), creating an inconsistent code path. The root cause is CWE-862 (Missing Authorization): a missing access control check on an object-level action. The fix (commit ded6515) restructures the method to first look up the Actionlog record by filename, then immediately authorize view access on the associated item (Asset or License) before any storage-path branching occurs.

RemediationAI

Vendor-released patch: 8.5.1. Upgrade to Snipe-IT 8.5.1, which contains commit ded6515cbc27a28f07395da318483c2e96263259. The patch moves the Actionlog lookup and authorization check before any storage-path branching, ensuring S3 and local-file paths are both gated consistently. The fix reference is https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259. If an immediate upgrade is not possible, a compensating control is to restrict S3 bucket permissions so that the IAM role or credentials used by Snipe-IT cannot generate pre-signed URLs for the signatures prefix, effectively breaking the bypass but also breaking legitimate signature retrieval for all users - weigh this trade-off carefully in environments that rely on electronic acceptance workflows. Alternatively, temporarily migrating to local-file storage (if infrastructure permits) causes the authorization check to be enforced and eliminates the vulnerable path, though this may have operational impact on multi-instance or cloud deployments.