Snipe‑IT, an IT asset and license management system, contains a flaw in its S3‑backed signature image retrieval process. Before version 8.6.1, authenticated users who know a signature image’s filename can request a temporary 5‑minute signed URL. Because the code path handling S3 requests returns before the framework’s `authorize()` check used for local‑file storage, the authorization step is effectively bypassed. As a result, any authenticated user can access signature images without proof of permission. This represents a Missing Authorization weakness (CWE‑862) and can expose confidential asset images to insiders or compromised accounts.

The issue affects the Snipe‑IT asset manager written by grokability. Any deployment using S3 for signature image storage prior to version 8.6.1 is susceptible. Version 8.6.1 and later contain the fix.

The CVSS score of 1.3 indicates low severity and the EPSS score of < 1% indicates a very low exploitation probability, but the vulnerability still matters because it requires legitimate authentication; an attacker with valid credentials can exploit the flaw to retrieve the application’s signature images. The vulnerability is not listed in CISA’s KEV catalog, meaning it may not yet have widespread exploitation. The missing authorization before the S3 URL generation is the root problem, and the exposure is brief but still valuable to an insider or compromised actor.