CVE-2026-109562: Missing Authorization in snapotter-hq SnapOtter
Description
SnapOtter versions 1.15.10 through 2.2.0 have a missing authorization vulnerability allowing any authenticated user with a settings:read-scoped API key to access certain API endpoints without proper permission checks. This enables unauthorized calls to upload, preview, and generate preview handlers, potentially allowing attackers to stage arbitrary files beyond storage quotas and serve them unauthenticated. Crafted inputs can also be fed to image and video decoders.
CVSS v4.0
Score 5.3medium
Affected software
snapotter-hq
SnapOtter
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109562 describes a missing authorization vulnerability in SnapOtter versions 1.15.10 through 2.2.0. Authenticated principals holding even limited API keys (settings:read-scoped) can invoke the /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate endpoints without permission checks. This flaw allows attackers to stage arbitrary files outside of storage quotas, which can then be served unauthenticated via /api/v1/download. Additionally, attackers can supply crafted inputs to image and video decoders, potentially leading to further impact.
Potential Impact
The vulnerability allows unauthorized authenticated users to bypass permission checks on critical API endpoints, enabling file staging beyond storage quotas and unauthenticated file downloads. This could lead to unauthorized data exposure or manipulation. The ability to feed crafted inputs to media decoders may introduce additional risks, though specific impacts are not detailed.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API key permissions to the minimum necessary and monitor usage of the affected endpoints for suspicious activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T19:27:52.288Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd4b462cdf04f656d3ef66
Added to database: 10/12/2026, 21:04:06 UTC
Last enriched: 10/12/2026, 21:19:29 UTC
Last updated: 10/12/2026, 21:19:29 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.