CVE-2026-55703

Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Traduire en français

Produits concernés

• grokability snipe-it
• Snipeitapp snipe-it

Scores CVSS

Faiblesses (CWE)

• CWE-862

Références

• https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96 Patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.3 Release NotesPatch
• https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q ExploitPatchVendor Advisory
• https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q ExploitPatchVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories