CVE-2026-55542: Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL

June 23, 2026

Snipe-IT S3 signature image retrieval lacks authorization before temporary URL.

On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize() call used by the local-file branch.

References

github.com/advisories/GHSA-6mmj-jhqj-6c6q
github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259
github.com/grokability/snipe-it/security/advisories/GHSA-6mmj-jhqj-6c6q
nvd.nist.gov/vuln/detail/CVE-2026-55542

Code Behaviors & Features

Detect and mitigate CVE-2026-55542 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →