CVE-2026-55703
MediumCVSS 4.3Summary
Snipe-IT prior to 8.6.3 allows any activated account to read maintenance records for assets in the same company without asset or maintenance permission. The show() method lacks authorization, disclosing asset tags, suppliers, purchase costs, notes, and dates.
Risk Assessment
The risk includes unauthorized access to sensitive asset and maintenance information, potentially compromising data confidentiality.
Recommendation
Update to version 8.6.3 or later and implement proper access controls for maintenance records.
Original NVD description (English source)
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.