Is CVE-2026-55703 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55703 being exploited in the wild.

How severe is CVE-2026-55703?

Medium severity, with a CVSS score of 4.3, published 19 August 2026.

Which products and versions are affected?

snipe/snipe-it (Packagist) < 8.6.3, ECOSYSTEM:introduced=0,fixed=8.6.3.

Is there a fix for CVE-2026-55703?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55703 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55703?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55703: Snipe-IT maintenance record disclosure via missing authorization

Q: Is there a fix for CVE-2026-55703?

Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55703 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55703?

Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55703 · Severity: medium · CVSS 4.3 · Published 2026-08-19

Snipe-IT is a web-based asset management platform used to track corporate IT hardware and maintenance. A missing permission check allows any employee with a company account—even those with no assigned permissions—to view detailed maintenance records (including asset costs, supplier information, and repair notes) by directly accessing specific record URLs. This bypasses the application's intended access controls and exposes sensitive financial and operational data.

Technologies: snipe/snipe-it (Packagist), Snipeitapp Snipe-It. Vendors: Packagist, Snipeitapp.

Quick answers

Is CVE-2026-55703 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55703 being exploited in the wild.
How severe is CVE-2026-55703?: Medium severity, with a CVSS score of 4.3, published 19 August 2026.
Which products and versions are affected?: snipe/snipe-it (Packagist) < 8.6.3, ECOSYSTEM:introduced=0,fixed=8.6.3.
Is there a fix for CVE-2026-55703?: Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55703 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55703?: Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snipe/snipe-it (Packagist): upgrade to 8.6.3 or later
```
composer require snipe/snipe-it:^8.6.3
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in the MaintenancesController::show() action. The affected method renders a maintenance record view without calling authorize(), while all sibling actions (index, edit, update, destroy) correctly enforce authorization gates. The route is protected only by authentication middleware, allowing any logged-in user within the same company to access the view. The route-model binding enforces company-scope isolation, but the missing permission gate is the defect. Maintenance IDs are sequential and visible in URLs, making them trivial to enumerate. An attacker requires only an authenticated account in the target company—no special permissions needed—to read all maintenance details including costs and notes. The fix involves adding an authorize() call for asset access in the show() method. Patch available in version 8.6.3.

Affected products

Grokability Snipe-IT < 8.6.3

Identifiers

CVE-2026-55703
GHSA-r9r3-g9fp-3q4q

Timeline

2026-08-19: disclosed
2026-08-19: patched: Fixed in version 8.6.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.