Executive brief
Snipe-IT is an asset management system used by organizations to track inventory and enforce policy compliance. An attacker with low-level access can exploit a combination of API information disclosure and broken authorization controls to download confidential EULA documents belonging to any other user in the system, completely bypassing security protections that randomize file names.
Technical details
This vulnerability chains two separate authorization flaws in Snipe-IT: an information disclosure in the /api/v1/users/{target_id}/eulas endpoint that leaks the secret filenames of EULA files for any user, and a broken access control in the /account/stored-eula-file/ route that does not properly validate authorization before serving files. An authenticated attacker (requiring low privilege/restricted user status) can first query the API to retrieve the randomized EULA filename for a target user, then bypass the properly-restricted main /stored-eula-file/ route by accessing the same file via the vulnerable /account/stored-eula-file/ path, which returns HTTP 200 and the file content. The attack requires network access and valid authentication credentials but no user interaction. An attacker can fully compromise the confidentiality of any user's signed EULA documents. The vendor patched this in version 8.6.3.
Affected products
- grokability Snipe-IT < 8.6.3
Timeline
- 2026-08-19: disclosed: Published to GitHub Advisory Database
- 2026-08-19: patched: Fixed in version 8.6.3