EUVD-2026-42398
GHSA-6mmj-jhqj-6c6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web endpoint (AV:N), low complexity once filename is known (AC:L), requires authenticated session (PR:L), confidentiality-only impact limited to signature images (C:L), no integrity or availability impact.
Primary rating from Vendor (https://github.com/grokability/snipe-it).
CVSS VectorVendor: https://github.com/grokability/snipe-it
Lifecycle Timeline
3DescriptionCVE.org
Impact
Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.
On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch.
Key evidence
routes/web.php:135-143; app/Http/Controllers/ActionlogController.php:16-44; app/Http/Controllers/Account/AcceptanceController.php:160,175; app/Listeners/LogListener.php:56; app/Http/Transformers/ActionlogsTransformer.php:188
Patches
Patched in https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259
Credit
Disclosed by Ikaro tiagonas
AnalysisAI
Signature image retrieval in Snipe-IT's S3-backed deployments bypasses authorization, allowing any authenticated user to obtain a 5-minute pre-signed S3 URL for acceptance signature images they are not permitted to view. The flaw exists in ActionlogController.php where the S3 code path returns a signed URL before the authorize() call is reached - a call that is correctly enforced only in the local-file code path. Affected are all Snipe-IT deployments on versions <= 8.5.0 configured to use S3 storage; no public exploit code exists and this CVE is not listed in CISA KEV.
Technical ContextAI
Snipe-IT is an open-source PHP/Laravel IT asset management application (composer package snipe/snipe-it). The affected code lives in app/Http/Controllers/ActionlogController.php in the displaySig() method, routed via routes/web.php:135-143. When storage is backed by Amazon S3 (or compatible), the method generates a time-limited pre-signed URL. However, the authorization gate ($this->authorize('view', ...)) was placed after the S3 branch's early return, meaning the S3 path never executed the gate. The local-file branch did call authorize(), creating an inconsistent code path. The root cause is CWE-862 (Missing Authorization): a missing access control check on an object-level action. The fix (commit ded6515) restructures the method to first look up the Actionlog record by filename, then immediately authorize view access on the associated item (Asset or License) before any storage-path branching occurs.
RemediationAI
Vendor-released patch: 8.5.1. Upgrade to Snipe-IT 8.5.1, which contains commit ded6515cbc27a28f07395da318483c2e96263259. The patch moves the Actionlog lookup and authorization check before any storage-path branching, ensuring S3 and local-file paths are both gated consistently. The fix reference is https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259. If an immediate upgrade is not possible, a compensating control is to restrict S3 bucket permissions so that the IAM role or credentials used by Snipe-IT cannot generate pre-signed URLs for the signatures prefix, effectively breaking the bypass but also breaking legitimate signature retrieval for all users - weigh this trade-off carefully in environments that rely on electronic acceptance workflows. Alternatively, temporarily migrating to local-file storage (if infrastructure permits) causes the authorization check to be enforced and eliminates the vulnerable path, though this may have operational impact on multi-instance or cloud deployments.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today