Medium severity4.3NVD Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-55542
CVE-2026-55542
Description
Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch. Version 8.6.1 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
snipe/snipe-itPackagist | < 8.5.1 | 8.5.1 |
Affected products
3- Range: <8.6.1
Patches
Vulnerability mechanics
References
3- github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259nvdPatchWEB
- github.com/grokability/snipe-it/security/advisories/GHSA-6mmj-jhqj-6c6qnvdPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-6mmj-jhqj-6c6qghsaADVISORY
News mentions
0No linked articles in our index yet.