CVE-2026-55703: Snipe-IT Information Disclosure Flaw

CVE-2026-55703 Overview

CVE-2026-55703 is a missing authorization vulnerability [CWE-862] in Snipe-IT, an open-source IT asset and license management system. Any activated user account can request /maintenances/{id} and read maintenance records for assets in the same company. The flaw exists because the show() method in app/Http/Controllers/MaintenancesController.php renders records without calling authorize(). Company-scoped route-model binding only restricts cross-company access, not per-user permissions. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. The issue is fixed in Snipe-IT version 8.6.3.

Critical Impact
Authenticated users without asset or maintenance permissions can enumerate sensitive asset maintenance data, including purchase costs, suppliers, and internal notes across their company tenant.

Affected Products

Snipe-IT versions prior to 8.6.3
app/Http/Controllers/MaintenancesController.phpshow() endpoint
Any Snipe-IT deployment with multiple activated user accounts

Discovery Timeline

2026-08-19 - CVE-2026-55703 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-55703

Vulnerability Analysis

Snipe-IT enforces authorization through Laravel policy classes invoked by authorize() calls in controllers. The MaintenancesController@show method omitted this authorization check. Any authenticated user could send a GET request to /maintenances/{id} and receive a rendered view containing the maintenance record.

Route-model binding in Snipe-IT is company-scoped, so cross-tenant access is blocked automatically. However, no gate verifies that the requesting user holds the view permission on the underlying asset. This allows lateral disclosure inside a single company tenant.

Exposed fields include asset tag identifiers, supplier names, purchase costs, free-form notes, and maintenance dates. Attackers with low-privilege accounts can enumerate integer {id} values to harvest the maintenance dataset.

Root Cause

The root cause is a missing authorization check [CWE-862]. The show() action rendered the view without invoking the view policy against the parent asset. The patch adds $this->authorize('view', $maintenance->asset) before returning the view, delegating access control to the existing AssetPolicy.

Attack Vector

Exploitation requires a valid, activated account on the target Snipe-IT instance. The attacker iterates through numeric maintenance identifiers by issuing authenticated GET requests to /maintenances/{id}. Each request returns the maintenance detail view when the record belongs to the attacker's company, regardless of asset-level permissions.

php

     */
    public function show(Maintenance $maintenance): View|RedirectResponse
    {
+       $this->authorize('view', $maintenance->asset);
+
        return view('maintenances.view')->with('maintenance', $maintenance);
    }
}

Source: GitHub Commit 69c50aa. The patch inserts a policy check that defers to the asset's view gate before rendering the record.

Detection Methods for CVE-2026-55703

Indicators of Compromise

Sequential GET requests from a single authenticated session to /maintenances/{id} with incrementing numeric IDs
Unusual volume of HTTP 200 responses on /maintenances/* routes from low-privileged accounts
Web server access logs showing enumeration patterns against the maintenances endpoint outside normal usage windows

Detection Strategies

Review Snipe-IT web server logs for accounts accessing /maintenances/{id} when those accounts lack maintenance or asset roles
Correlate user role assignments with maintenance endpoint access to flag unauthorized reads
Alert on high-rate ID enumeration patterns against the maintenances route

Monitoring Recommendations

Ingest Snipe-IT application and web server logs into a centralized SIEM for query and retention
Build dashboards tracking per-user request volume against /maintenances/* endpoints
Establish a baseline for maintenance record access and alert on statistical outliers

How to Mitigate CVE-2026-55703

Immediate Actions Required

Upgrade Snipe-IT to version 8.6.3 or later, which introduces the authorize('view', $maintenance->asset) check
Audit application access logs for prior unauthorized reads against /maintenances/{id}
Review and tighten role assignments so that only users needing maintenance visibility hold the corresponding asset view permission

Patch Information

The fix is included in Snipe-IT 8.6.3. Reference materials include the GitHub Release Notes for v8.6.3, the GitHub Security Advisory GHSA-r9r3-g9fp-3q4q, and the remediation commit 69c50aa.

Workarounds

If immediate patching is not possible, restrict Snipe-IT access to trusted users only and deactivate accounts that do not require asset visibility
Place a reverse proxy or web application firewall rule in front of /maintenances/{id} to block requests from user groups that should not access maintenance data
Monitor the maintenances endpoint aggressively until the upgrade is deployed

bash

# Upgrade Snipe-IT to the patched release
cd /var/www/snipe-it
sudo -u www-data git fetch --tags
sudo -u www-data git checkout v8.6.3
sudo -u www-data composer install --no-dev --prefer-source
sudo -u www-data php artisan migrate --force
sudo -u www-data php artisan config:clear
sudo -u www-data php artisan cache:clear