{"id":"CVE-2026-55542","title":"Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL ","summary":"Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL ","severity":"low","cwe":["CWE-862"],"vendor":"snipe","product":"snipe/snipe-it","ecosystem":"composer","affected":["snipe/snipe-it <= 8.5.0"],"patched":["snipe/snipe-it 8.5.1"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6mmj-jhqj-6c6q","references":[{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-6mmj-jhqj-6c6q"},{"url":"https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259"},{"url":"https://github.com/advisories/GHSA-6mmj-jhqj-6c6q"}],"tags":["ghsa","composer"],"ingestedAt":"2026-06-26T16:43:14.572Z","epss":0.00281,"epssPercentile":0.20847,"slug":"CVE-2026-55542","body":"## Overview\n\n### Impact\n Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.\n\nOn S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch.\n\n## Key evidence\n`routes/web.php:135-143`; `app/Http/Controllers/ActionlogController.php:16-44`; `app/Http/Controllers/Account/AcceptanceController.php:160,175`; `app/Listeners/LogListener.php:56`; `app/Http/Transformers/ActionlogsTransformer.php:188`\n\n\n### Patches\nPatched in  https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259 \n\n### Credit\nDisclosed by Ikaro tiagonas\n\n## Affected packages\n\n- `snipe/snipe-it <= 8.5.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snipe/snipe-it 8.5.1`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}