CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.3 are vulnerable to unauthorized access, allowing restricted users to request and download another user's signed End User License Agreement (EULA) file. This flaw arises from inconsistent enforcement of ownership and user authorization in the application's API endpoints. Organizations using affected versions should prioritize upgrading to 8.6.3 to mitigate the risk of sensitive data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/{filename}. The primary /stored-eula-file/{filename} route correctly denies access, but app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization. This issue is fixed in version 8.6.3.