DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55694: CVE-2026-55694: Chained Information Disclosure and IDOR in Snipe-IT EULA Management

#security #cve #cybersecurity

CVE-2026-55694: Chained Information Disclosure and IDOR in Snipe-IT EULA Management

Vulnerability ID: CVE-2026-55694
CVSS Score: 7.1
Published: 2026-08-19

CVE-2026-55694 is a chained Information Disclosure and Insecure Direct Object Reference (IDOR) vulnerability in Snipe-IT prior to version 8.6.3. The vulnerability allows authenticated, restricted users to completely bypass randomized file-naming security controls, leak the obfuscated filenames of signed End User License Agreements (EULAs), and subsequently download these confidential documents across tenant boundaries.

TL;DR

Chained IDOR and information disclosure in Snipe-IT allows authenticated, low-privileged users to bypass file name randomization and download signed EULAs of any user.

Technical Details

  • CWE ID: CWE-639
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 7.1 (High)
  • Exploit Status: None
  • KEV Status: Not Listed
  • Ransomware Association: No
  • Vulnerability Class: Information Disclosure & IDOR Chain

Affected Systems

  • Snipe-IT Asset Management System
  • Snipe-IT: < 8.6.3 (Fixed in: 8.6.3)

Code Analysis

Commit: f15d786

Fix: IDOR vulnerability in EULA download via ProfileController and UsersController API

@@ -893,7 +893,7 @@ public function getCurrentUserInfo(Request $request): array
      */
     public function eulas(User $user, ActionlogsTransformer $transformer)
     {
-        $this->authorize('view', User::class);
+        $this->authorize('view', $user);
Enter fullscreen mode Exit fullscreen mode

Mitigation Strategies

  • Upgrade Snipe-IT to version 8.6.3 or higher.
  • Block traffic to vulnerable EULA API and profile download routes at the reverse proxy or web server layer.
  • Perform audit log analysis to detect sequential requests targeting user EULA endpoints.

Remediation Steps:

  1. Navigate to the Snipe-IT installation directory.
  2. Pull the latest updates and switch to the patched release branch using 'git checkout v8.6.3'.
  3. Run 'composer install --no-dev --prefer-dist' to update dependencies.
  4. Run 'php artisan migrate' to ensure database structures are up to date.
  5. Clear the application cache using 'php artisan config:clear' and 'php artisan cache:clear'.

References

Read the full report for CVE-2026-55694 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)