Executive brief
Snipe-IT is a web-based asset management platform used to track corporate IT hardware and maintenance. A missing permission check allows any employee with a company account—even those with no assigned permissions—to view detailed maintenance records (including asset costs, supplier information, and repair notes) by directly accessing specific record URLs. This bypasses the application's intended access controls and exposes sensitive financial and operational data.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the MaintenancesController::show() action. The affected method renders a maintenance record view without calling authorize(), while all sibling actions (index, edit, update, destroy) correctly enforce authorization gates. The route is protected only by authentication middleware, allowing any logged-in user within the same company to access the view. The route-model binding enforces company-scope isolation, but the missing permission gate is the defect. Maintenance IDs are sequential and visible in URLs, making them trivial to enumerate. An attacker requires only an authenticated account in the target company—no special permissions needed—to read all maintenance details including costs and notes. The fix involves adding an authorize() call for asset access in the show() method. Patch available in version 8.6.3.
Affected products
- Grokability Snipe-IT < 8.6.3
Timeline
- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 8.6.3