CVE-2026-55703

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.6.3

Description An issue exists where any activated account can access maintenance records for assets within the same company without requiring specific asset or maintenance permissions. This occurs because the show() function in app/Http/Controllers/MaintenancesController.php renders the record without calling authorize(), and the company-scoped route-model binding only restricts access to other companies. An attacker can request the '/maintenances/{id}' endpoint to disclose sensitive information, including asset tags, suppliers, purchase costs, notes, and dates.

Recommendations Update to version 8.6.3.