CVE-2026-55694 is an authorization bypass vulnerability in Snipe-IT, an IT asset/license management system. Before version 8.6.3, restricted users can request the endpoint /api/v1/users/{target_id}/eulas to obtain another user's randomized EULA filename and then download the signed EULA file via /account/stored-eula-file/{filename}. While the primary route /stored-eula-file/{filename} correctly enforces access restrictions, the controllers app/Http/Controllers/ProfileController.php and app/Http/Controllers/Api/UsersController.php do not consistently enforce ownership and target-user authorization, enabling unauthorized access to EULA files. This flaw is addressed in Snipe-IT version 8.6.3.

An attacker with restricted user privileges can access and download signed EULA files belonging to other users without proper authorization. This leads to unauthorized disclosure of potentially sensitive signed documents. There is no indication of privilege escalation or code execution. The CVSS 4.0 base score is 7.1 (high), reflecting network attack vector, low attack complexity, no privileges required beyond restricted user, no user interaction, and high impact on confidentiality.

Upgrade Snipe-IT to version 8.6.3 or later, where this authorization bypass vulnerability is fixed. There is no official vendor advisory provided here, but the description explicitly states the issue is resolved in 8.6.3. Until upgrading, restrict access to the affected API endpoints and monitor for unauthorized access attempts if possible.