CVE-2026-55703: Missing Authorization in Snipe-IT Maintenance Records
Vulnerability ID: CVE-2026-55703
CVSS Score: 4.3
Published: 2026-08-19
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
TL;DR
An insecure direct object reference (IDOR) flaw in Snipe-IT allows any authenticated user to view asset maintenance logs and financial/vendor data without permission.
Technical Details
- CWE ID: CWE-862
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 4.3 (Medium)
- Impact: Partial Confidentiality Loss
- Exploit Status: No public PoC
- KEV Status: Not Listed
Affected Systems
- Snipe-IT
Mitigation Strategies
- Upgrade Snipe-IT to version 8.6.3 or higher
- Implement network access controls to isolate the asset management console
- Monitor web logs for sequential ID scanning of /maintenances/
Remediation Steps:
- Verify current Snipe-IT version through the admin dashboard
- Apply security update using standard composer commands or docker image update
- Perform a verification check attempting to view asset maintenance with a test non-admin user account
References
- GitHub Security Advisory GHSA-r9r3-g9fp-3q4q
- Patch Commit
- v8.6.3 Release Notes
- NVD CVE-2026-55703
- CVE.org CVE-2026-55703
Read the full report for CVE-2026-55703 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)