Is CVE-2026-55694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55694 being exploited in the wild.

How severe is CVE-2026-55694?

High severity, with a CVSS score of 6.5, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) < 8.6.3, ECOSYSTEM:introduced=0,fixed=8.6.3.

Is there a fix for CVE-2026-55694?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55694 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55694?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55694: Snipe-IT authorization bypass in EULA file access

Q: Is there a fix for CVE-2026-55694?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55694 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55694?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55694 · Severity: high · CVSS 6.5 · Published 2026-08-19

Snipe-IT is an asset management system used by organizations to track inventory and enforce policy compliance. An attacker with low-level access can exploit a combination of API information disclosure and broken authorization controls to download confidential EULA documents belonging to any other user in the system, completely bypassing security protections that randomize file names.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-55694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55694 being exploited in the wild.
How severe is CVE-2026-55694?: High severity, with a CVSS score of 6.5, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) < 8.6.3, ECOSYSTEM:introduced=0,fixed=8.6.3.
Is there a fix for CVE-2026-55694?: Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55694 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55694?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.6.3 or later
```
composer require snipe/snipe-it:^8.6.3
```

Technical details

This vulnerability chains two separate authorization flaws in Snipe-IT: an information disclosure in the /api/v1/users/{target_id}/eulas endpoint that leaks the secret filenames of EULA files for any user, and a broken access control in the /account/stored-eula-file/ route that does not properly validate authorization before serving files. An authenticated attacker (requiring low privilege/restricted user status) can first query the API to retrieve the randomized EULA filename for a target user, then bypass the properly-restricted main /stored-eula-file/ route by accessing the same file via the vulnerable /account/stored-eula-file/ path, which returns HTTP 200 and the file content. The attack requires network access and valid authentication credentials but no user interaction. An attacker can fully compromise the confidentiality of any user's signed EULA documents. The vendor patched this in version 8.6.3.

Affected products

grokability Snipe-IT < 8.6.3

Identifiers

CVE-2026-55694
GHSA-3hgv-jr5j-cg9x

Timeline

2026-08-19: disclosed: Published to GitHub Advisory Database
2026-08-19: patched: Fixed in version 8.6.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.