SnapOtter versions 1.15.10 through 2.2.0 contain a missing authorization flaw that allows any authenticated principal to invoke the /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate endpoints without permission checks. The flaw lets a user stage arbitrary files outside the normal storage quota and subsequently serve those files through the unauthenticated /api/v1/download endpoint. Moreover, the application feeds the uploaded content to image and video decoders, which, if crafted maliciously, can potentially lead to code execution or other adverse effects on the host system.

The affected product is SnapOtter by snapotter-hq, with vulnerable releases ranging from 1.15.10 up to and including 2.2.0.

The vulnerability is scored as 5.3 on the CVSS base metric, indicating a moderate severity. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog. Attackers only need a credentials that provide the settings:read scope to trigger the abuse, which they can then use to upload malicious files, exfiltrate data, or exploit decoder vulnerabilities.