A restricted internal user can exploit an information disclosure flaw and an IDOR in the Snipe‑IT API to learn another user's randomized EULA filename and then download the signed file through a separate route. By chaining these requests the attacker bypasses ownership checks and can retrieve any EULA document that has been signed by an administrator, exposing potentially sensitive contractual information and compromising confidentiality.

The vulnerability exists in all Snipe‑IT releases distributed by grokability that are older than version 8.6.3. It involves the /api/v1/users/{target_id}/eulas endpoint and the /account/stored‑eula‑file/{filename} route when accessed via the ProfileController and Api/UsersController.

The CVSS score of 7.1 indicates a high severity, and the issue is not yet listed in the CISA KEV catalog. No EPSS score is available, so the probability of exploitation is unclear, but the presence of an IDOR means a legitimate but limited user could exploit the flaw without additional credentials. The fix is incorporated in Snipe‑IT 8.6.3, so updating is strongly recommended to eliminate the risk.