CVE-2026-55542: Transformers auth bypass exposes S3

Q: Is CVE-2026-55542 actively exploited?

No confirmed active exploitation of CVE-2026-55542 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55542?

1. Patch immediately: Upgrade snipe/snipe-it to version 8.5.1 which resolves the issue via commit ded6515cbc27a28f07395da318483c2e96263259 by ensuring authorize() executes before any S3 URL generation in ActionlogController. 2. Workaround (pre-patch): Apply WAF or middleware rules to restrict access to /api/v1/actionlogs signature endpoints and /account/accept routes to only roles that legitimately require asset acceptance functionality. 3. Detection: Audit S3 server access logs for GetObject requests on signature objects originating from users outside expected asset acceptance workflows; correlate ActionlogController HTTP access logs against user-asset assignment records to identify anomalous cross-user signature retrievals. 4. Verify remediation: After upgrading, confirm the patched ActionlogController invokes authorize() before the S3 URL generation branch by reviewing the diff at the referenced commit; run a functional test attempting signature retrieval with a user not assigned to the target asset.

Q: What systems are affected by CVE-2026-55542?

This vulnerability affects the following AI/ML architecture patterns: IT asset management with S3-compatible object storage, AI infrastructure asset tracking workflows using Snipe-IT.

Q: What is the CVSS score for CVE-2026-55542?

No CVSS score has been assigned yet.

CISO Take

CVE-2026-55542 is a missing authorization check in Snipe-IT's S3-backed signature image retrieval endpoint — any authenticated user who knows a signature filename can obtain a valid 5-minute pre-signed S3 URL for that image, silently bypassing the intended access control gate because the S3 code path returns before the authorize() call executes. The flaw is constrained in blast radius: exploitation requires a valid session (not anonymous access), impact is limited to signature image disclosure rather than arbitrary file or credential access, no public exploit exists, and the CVE is absent from the CISA KEV catalog — all indicators of low active exploitation interest. Risk is elevated in environments where Snipe-IT signature workflows capture legally binding acknowledgments (NDAs, classified asset sign-offs) or where insider threat is a concern, given the trivial exploitation complexity for any credentialed user. Organizations running Snipe-IT on S3-compatible storage should upgrade to 8.5.1 immediately; as a temporary workaround, restrict network-level access to the ActionlogController and AcceptanceController endpoints via WAF rules.

Sources: GitHub Advisory NVD OpenSSF ATLAS

What is the risk?

Low overall risk. The attack surface is limited to authenticated sessions — anonymous exploitation is not possible — which significantly constrains the potential attacker population. Exposed data is restricted to signature images, not credentials, configuration secrets, or model artifacts. No public exploit code has been published and EPSS data is unavailable, suggesting minimal active community exploitation interest. The 5-minute signed URL TTL limits the utility of any intercepted URL. Risk escalates meaningfully in regulated environments (legal, government, finance) where electronic signatures represent enforceable documents, or if Snipe-IT is deployed as part of an AI infrastructure asset tracking workflow where signature compromise could undermine audit chain-of-custody.

How does the attack unfold?

Initial Access

Attacker authenticates to Snipe-IT with any valid low-privilege account obtained through normal employment or credential compromise.

AML.T0012

Reconnaissance

Attacker observes signature filename patterns from legitimate asset acceptance workflows they participate in, or enumerates predictable filenames from application behavior.

AML.T0049

Authorization Bypass

Attacker requests the ActionlogController signature endpoint with a target filename; the S3 code branch returns a signed URL before the authorize() check executes, silently skipping access control.

AML.T0049

Data Exfiltration

Attacker uses the 5-minute pre-signed S3 URL to download the target signature image, obtaining unauthorized access to asset acceptance signatures belonging to other users.

AML.T0025

Initial Access

Attacker authenticates to Snipe-IT with any valid low-privilege account obtained through normal employment or credential compromise.

AML.T0012

Reconnaissance

Attacker observes signature filename patterns from legitimate asset acceptance workflows they participate in, or enumerates predictable filenames from application behavior.

AML.T0049

Authorization Bypass

Attacker requests the ActionlogController signature endpoint with a target filename; the S3 code branch returns a signed URL before the authorize() check executes, silently skipping access control.

AML.T0049

Data Exfiltration

Attacker uses the 5-minute pre-signed S3 URL to download the target signature image, obtaining unauthorized access to asset acceptance signatures belonging to other users.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Transformers	composer	<= 8.5.0	`8.5.1`
163.2K OpenSSF 6.5 9.0K dependents Pushed 7d ago 43% patched ~87d to patch Full package profile →

Do you use Transformers? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

4 steps

Patch immediately: Upgrade snipe/snipe-it to version 8.5.1 which resolves the issue via commit ded6515cbc27a28f07395da318483c2e96263259 by ensuring authorize() executes before any S3 URL generation in ActionlogController.
Workaround (pre-patch): Apply WAF or middleware rules to restrict access to /api/v1/actionlogs signature endpoints and /account/accept routes to only roles that legitimately require asset acceptance functionality.
Detection: Audit S3 server access logs for GetObject requests on signature objects originating from users outside expected asset acceptance workflows; correlate ActionlogController HTTP access logs against user-asset assignment records to identify anomalous cross-user signature retrievals.
Verify remediation: After upgrading, confirm the patched ActionlogController invokes authorize() before the S3 URL generation branch by reviewing the diff at the referenced commit; run a functional test attempting signature retrieval with a user not assigned to the target asset.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.1.2 - Access control policy

NIST AI RMF

GOVERN 1.2 - Accountability and governance structures for AI risk

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-55542?

CVE-2026-55542 is a missing authorization check in Snipe-IT's S3-backed signature image retrieval endpoint — any authenticated user who knows a signature filename can obtain a valid 5-minute pre-signed S3 URL for that image, silently bypassing the intended access control gate because the S3 code path returns before the authorize() call executes. The flaw is constrained in blast radius: exploitation requires a valid session (not anonymous access), impact is limited to signature image disclosure rather than arbitrary file or credential access, no public exploit exists, and the CVE is absent from the CISA KEV catalog — all indicators of low active exploitation interest. Risk is elevated in environments where Snipe-IT signature workflows capture legally binding acknowledgments (NDAs, classified asset sign-offs) or where insider threat is a concern, given the trivial exploitation complexity for any credentialed user. Organizations running Snipe-IT on S3-compatible storage should upgrade to 8.5.1 immediately; as a temporary workaround, restrict network-level access to the ActionlogController and AcceptanceController endpoints via WAF rules.

Is CVE-2026-55542 actively exploited?

No confirmed active exploitation of CVE-2026-55542 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55542?

1. Patch immediately: Upgrade snipe/snipe-it to version 8.5.1 which resolves the issue via commit ded6515cbc27a28f07395da318483c2e96263259 by ensuring authorize() executes before any S3 URL generation in ActionlogController. 2. Workaround (pre-patch): Apply WAF or middleware rules to restrict access to /api/v1/actionlogs signature endpoints and /account/accept routes to only roles that legitimately require asset acceptance functionality. 3. Detection: Audit S3 server access logs for GetObject requests on signature objects originating from users outside expected asset acceptance workflows; correlate ActionlogController HTTP access logs against user-asset assignment records to identify anomalous cross-user signature retrievals. 4. Verify remediation: After upgrading, confirm the patched ActionlogController invokes authorize() before the S3 URL generation branch by reviewing the diff at the referenced commit; run a functional test attempting signature retrieval with a user not assigned to the target asset.

What systems are affected by CVE-2026-55542?

This vulnerability affects the following AI/ML architecture patterns: IT asset management with S3-compatible object storage, AI infrastructure asset tracking workflows using Snipe-IT.

What is the CVSS score for CVE-2026-55542?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

IT asset management with S3-compatible object storageAI infrastructure asset tracking workflows using Snipe-IT

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

### Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch. ## Key evidence `routes/web.php:135-143`; `app/Http/Controllers/ActionlogController.php:16-44`; `app/Http/Controllers/Account/AcceptanceController.php:160,175`; `app/Listeners/LogListener.php:56`; `app/Http/Transformers/ActionlogsTransformer.php:188` ### Patches Patched in https://github.com/grokability/snipe-it/commit/ded6515cbc27a28f07395da318483c2e96263259 ### Credit Disclosed by Ikaro tiagonas

Exploitation Scenario

A low-privilege employee at an organization using Snipe-IT to manage AI infrastructure assets (GPU workstations, edge inference servers) logs into the application with their standard helpdesk credentials. By observing network requests in browser developer tools during a legitimate asset acceptance workflow, they identify the signature filename pattern used by the ActionlogController endpoint. They then craft direct HTTP requests to the signature retrieval endpoint substituting filenames for other users' asset acceptances — including an executive's signature on an NDA for a new AI vendor contract. Because the S3 branch returns the pre-signed URL before reaching the authorize() check, the application responds with a valid 5-minute S3 URL. The attacker downloads the executive signature image within the window, exfiltrating a high-fidelity copy for potential use in fraudulent document preparation. In a more systematic insider threat scenario, the attacker scripts enumeration of predictable filename patterns to harvest a library of executive signatures over multiple sessions.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.