Skip to main content

Snipe-IT CVE-2026-55542

| EUVDEUVD-2026-42398 LOW
Missing Authorization (CWE-862)
2026-06-23 https://github.com/grokability/snipe-it GHSA-6mmj-jhqj-6c6q
PHP Authentication Bypass
1.3
CVSS 4.0 · Vendor: https://github.com/grokability/snipe-it

Severity by source

Vendor (https://github.com/grokability/snipe-it) PRIMARY
1.3 LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-reachable web endpoint (AV:N), low complexity once filename is known (AC:L), requires authenticated session (PR:L), confidentiality-only impact limited to signature images (C:L), no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/grokability/snipe-it).

CVSS VectorVendor: https://github.com/grokability/snipe-it

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Jul 08, 2026 - 21:22 NVD
1.3 (LOW)
Source Code Evidence Fetched
Jun 23, 2026 - 23:53 vuln.today
Analysis Generated
Jun 23, 2026 - 23:53 vuln.today

DescriptionCVE.org

Impact

Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.

On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch.

Key evidence

routes/web.php:135-143; app/Http/Controllers/ActionlogController.php:16-44; app/Http/Controllers/Account/AcceptanceController.php:160,175; app/Listeners/LogListener.php:56; app/Http/Transformers/ActionlogsTransformer.php:188

Patches

Patched in https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259

Credit

Disclosed by Ikaro tiagonas

AnalysisAI

Signature image retrieval in Snipe-IT's S3-backed deployments bypasses authorization, allowing any authenticated user to obtain a 5-minute pre-signed S3 URL for acceptance signature images they are not permitted to view. The flaw exists in ActionlogController.php where the S3 code path returns a signed URL before the authorize() call is reached - a call that is correctly enforced only in the local-file code path. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as any Snipe-IT user
Delivery
Discover valid signature filename via log exposure or pattern inference
Exploit
Request /log/signature/{filename} endpoint
Execution
S3 branch returns pre-signed URL before authorization check executes
Impact
Fetch signature image from S3 using pre-signed URL
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) an active authenticated session in Snipe-IT - unauthenticated users are redirected to login and cannot reach the endpoint; (2) the Snipe-IT instance must be configured to use S3-compatible object storage - deployments using local disk storage are not affected because the vulnerable early-return code path is only executed in the S3 branch; (3) the attacker must know or be able to guess or discover a valid acceptance signature filename for an actionlog record they are not authorized to view. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment No CVSS score was provided by the vendor; no EPSS data is available; the CVE is not in CISA KEV; and no public exploit code has been identified at time of analysis. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated Snipe-IT user with a low-privilege account (e.g., a help-desk technician) discovers or infers the filename of an acceptance signature associated with an asset they are not authorized to view - perhaps by observing a filename pattern from their own acceptance record or from partial log exposure via the transformer. They request the signature endpoint with that filename and receive a valid 5-minute pre-signed S3 URL, which they then use to download the signature image outside the application's authorization framework. …
Remediation Vendor-released patch: 8.5.1. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2025-20362 MEDIUM POC
6.5
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-55542 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy