Snipe-IT Information Disclosure and IDOR Vulnerability

Snipe-IT versions prior to 8.6.3 are susceptible to a chained vulnerability involving information disclosure and Insecure Direct Object Reference (IDOR). The vulnerability, identified as CVE-2026-55694, allows an authenticated user to bypass security controls designed to protect sensitive files. By querying the Snipe-IT API for EULA associations of arbitrary user accounts, an attacker can obtain the randomized, secret filenames of EULA documents stored on the server. Although the primary file retrieval endpoint correctly enforces access controls, an alternative profile-based route fails to validate authorization, allowing the attacker to download these confidential documents belonging to other users. This flaw poses a significant risk to the confidentiality of organizational documentation managed within the Snipe-IT asset management platform.

Attack Chain

1. Attacker authenticates to the Snipe-IT application as a standard, restricted user.
2. Attacker sends an authorized GET request to the API endpoint /api/v1/users/{target_id}/eulas.
3. The application returns the internal, randomized filename (e.g., eula-xxx.pdf) of the EULA assigned to the target user.
4. Attacker attempts to access the file via the main endpoint GET /stored-eula-file/{filename}, which is intercepted by security controls returning a 403 Forbidden.
5. Attacker pivots to the vulnerable route GET /account/stored-eula-file/{filename}.
6. The server fails to perform authorization checks on the account-based file retrieval route.
7. The server processes the request and returns a 200 OK with the target user's confidential EULA file.
8. Attacker successfully exfiltrates the sensitive document.

Impact

Successful exploitation allows unauthorized access to private, signed EULA files stored within the Snipe-IT instance. This can lead to the exposure of personally identifiable information (PII) or sensitive contractual agreements, impacting the confidentiality of all users registered in the system.

Recommendation

Prioritized, concrete actions for detection engineering and security teams:

• Update all instances of Snipe-IT to version 8.6.3 or later to remediate CVE-2026-55694.
• Enable web server access logging to capture full HTTP request paths for analysis.
• Deploy log monitoring for HTTP 200 OK responses originating from /account/stored-eula-file/ where the requesting user session does not align with the ownership of the accessed object.
• Review web server logs for high volumes of GET requests to /api/v1/users/ targeting varying numeric user IDs, which may indicate enumeration activity related to this IDOR.