CVE-2026-55694

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3

Description An issue exists where a restricted user can obtain another user's randomized EULA filename by requesting the '/api/v1/users/{target id}/eulas' endpoint. Subsequently, the signed file can be downloaded via the '/account/stored-eula-file/{filename}' endpoint. This occurs because app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization, despite the primary '/stored-eula-file/{filename}' route correctly denying access.

Recommendations Update to version 8.6.3.