Snipe‑IT permits an authenticated user who knows the name of a signature image to request a 5‑minute signed URL for that object stored in S3. On S3‑backed deployments, the path that generates the URL returns before the framework’s `authorize()` call – the protection used by the local‑file branch – meaning the authorization check never runs. Consequently, the application exposes the image to the requester without verifying that the user is allowed to view it. This flaw is a classic Missing Authorization weakness (CWE‑862).

The issue affects the Snipe‑IT asset manager written by grokability. Any deployment using S3 for signature image storage prior to version 8.6.1 is susceptible. Version 8.6.1 and later contain the fix.

The CVSS score of 1.3 indicates low severity and the EPSS score of < 1% indicates a very low exploitation probability, but the vulnerability still matters because it requires legitimate authentication; an attacker with valid credentials can exploit the flaw to retrieve the application’s signature images. The vulnerability is not listed in CISA’s KEV catalog, meaning it may not yet have widespread exploitation. The missing authorization before the S3 URL generation is the root problem, and the exposure is brief but still valuable to an insider or compromised actor.