CVE-2026-55542: Snipeitapp Snipe-It

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. Version 8.6.1 contains a patch.

Affected products

• Snipeitapp Snipe-It: before 8.6.0 (fixed in 8.6.0)

Published 2026-07-08. Last modified 2026-07-10.