Which versions of Snipe-IT are affected by CVE-2026-55694?

Snipe-IT asset management platform prior to version 8.6.3 contains an authorization bypass allowing any logged-in user to access confidential EULA documents belonging to other employees.. A patch is available.

How to fix or mitigate CVE-2026-55694?

Within 24 hours, audit your environment to identify all Snipe-IT instances and determine which are running versions prior to 8.6.3. Within 7 days, upgrade all vulnerable Snipe-IT installations to version 8.6.3 or later, prioritizing production systems. Within 30 days, review audit logs for the /api/v1/users/{id}/eulas and /account/stored-eula-file endpoints to identify whether unauthorized EULA access was exploited during the vulnerable window.

Snipe-IT CVE-2026-55694

Q: What is the CVSS score of CVE-2026-55694?

CVE-2026-55694 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-62631 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-19 GitHub_M

GHSA-3hgv-jr5j-cg9x

PHP Authentication Bypass Snipe It Grokability

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-exploitable by any authenticated low-privilege user; no integrity or availability impact; scope unchanged as exfiltration is limited to the vulnerable application's data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 19, 2026 - 19:18 EUVD

Source Code Evidence Fetched

Aug 19, 2026 - 19:07 vuln.today

Analysis Generated

Aug 19, 2026 - 19:07 vuln.today

CVE Published

Aug 19, 2026 - 18:28 cve.org

HIGH 7.1

DescriptionCVE.org

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.

AnalysisAI

Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.

Technical ContextAI

Snipe-IT is a PHP/Laravel open-source IT asset and license management platform (cpe:2.3:a:grokability:snipe-it:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a class of insecure direct object reference where user-supplied identifiers reach resource lookups without per-object authorization checks. In UsersController.php, the authorization call used the User class as its target ($this->authorize('view', User::class)) rather than the specific resolved user instance ($this->authorize('view', $user)), meaning Laravel's Gate evaluated whether the caller could view users in general - not whether they could view that particular user. ProfileController.php compounded the issue by allowing anyone holding both 'view users' and 'view assets' permissions to bypass ownership checks on the stored-eula-file download route. The commit fix (f15d78621b003be30ac114ba68626683894935ef) replaces class-level authorization with object-level authorization in both controllers and adds a null guard before any authorization logic runs.

RemediationAI

The primary fix is to upgrade Snipe-IT to version 8.6.3, which tightens authorization to object-level checks in both app/Http/Controllers/Api/UsersController.php and app/Http/Controllers/ProfileController.php. The vendor advisory is at https://github.com/grokability/snipe-it/security/advisories/GHSA-3hgv-jr5j-cg9x and the release is at https://github.com/grokability/snipe-it/releases/tag/v8.6.3. If an immediate upgrade is not possible, a viable compensating control is to restrict network access to the Snipe-IT instance so that only authorized personnel can authenticate - this reduces the pool of users who could exploit the IDOR but does not eliminate the flaw for legitimate restricted accounts. Alternatively, disabling the EULA workflow feature via application configuration removes the exploitable endpoints entirely, though this may break compliance workflows that rely on EULA signature tracking. Both workarounds carry operational trade-offs and should be treated as temporary bridges to patching, not permanent mitigations.