Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

TRUNG BÌNH 4.3CVE-2026-55542 · GHSA-6mmj-jhqj-6c6q · Công bố 08/07/2026 · cập nhật 25/10/2026

Tóm tắt nhanh

CVE-2026-55542 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng snipe/snipe-it, snipe-it (snipeitapp).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.28%, cao hơn 20.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 8.5.1, 8.6.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
snipe/snipe-it Packagist	`< 8.5.1`	`8.5.1`
snipe-it snipeitapp	`< 8.6.0`	`8.6.0`

Mô tả

Impact

Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.

On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch.

Key evidence

routes/web.php:135-143; app/Http/Controllers/ActionlogController.php:16-44; app/Http/Controllers/Account/AcceptanceController.php:160,175; app/Listeners/LogListener.php:56; app/Http/Transformers/ActionlogsTransformer.php:188

Patches

Patched in https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259

Credit

Disclosed by Ikaro tiagonas

Mô tả của NVD

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch.