Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Snipe-IT lets anyone fetch signature images from S3

CVE-2026-55542 · published 3 months ago
Summary

In versions before 8.6.1, Snipe-IT could give out temporary links to signature images stored in Amazon S3 without checking the user’s permission. Anyone who guessed the file name could see the image for up to five minutes. Upgrade to version 8.6.1 or later, or apply the provided patch, to enforce proper access control.

What to do
  • Update snipe snipe-it to version 8.5.1.
  • Update snipe snipe/snipe-it to version 8.5.1.
  • Update snipeitapp snipe-it to version 8.6.0 or later.
Affected software
Ecosystem VendorProductAffected versions
composer snipe snipe-it <= 8.5.0
Fix: upgrade to 8.5.1
Packagist snipe snipe/snipe-it < 8.5.1
Fix: upgrade to 8.5.1
– grokability snipe-it < 8.5.1
– snipeitapp snipe-it < 8.6.0
cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Original advisory text
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published8 Jul 2026
Updated3 Nov 2026
First seen24 Jun 2026
Sources
GHSA-6mmj-jhqj-6c6q · GHSA
CVE-2026-55542 · NVD
GHSA-6mmj-jhqj-6c6q · OSV
CVE-2026-55542 · MITRE
CVE-2026-55542 · OSV
Track software like this
Free during beta