Missing Authorization Vulnerability in SnapOtter by SnapOtter HQ

CVE-2026-109562

What is CVE-2026-109562?

SnapOtter versions 1.15.10 through 2.2.0 exhibit a missing authorization vulnerability that permits any authenticated user to access the /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate endpoints without necessary permission checks. This vulnerability enables attackers with valid settings:read-scoped API keys to upload arbitrary files beyond storage quotas. Additionally, these files can be downloaded through the /api/v1/download endpoint, bypassing authentication altogether. The exposure is further compounded as crafted inputs can be directed at image and video decoders, potentially leading to broader exploitation.

References