snapotter-hq CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM snapotter-hq CVE published 2026-10-12

CVE-2026-109562

CVE-2026-109562 debrief based on CVE Program and NVD records. SnapOtter versions 1.15.10 through 2.2.0 have a missing authorization vulnerability allowing authenticated users to call /api/v1/upload, /api/v1/preview, and /api/v1/preview/generate handlers without permission checks. This enables attackers with settings:read-scoped API keys to stage arbitrary files outside storage quota and feed crafted input [truncated]