# CVE-2026-55703: Snipe-IT maintenance record disclosure via missing authorization

Source: https://junglewise.ai/threats/cve-2026-55703-snipe-it-maintenance-record-disclosure-via-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55703 · Severity: medium · CVSS 4.3 · Published 2026-08-19

Snipe-IT is a web-based asset management platform used to track corporate IT hardware and maintenance. A missing permission check allows any employee with a company account—even those with no assigned permissions—to view detailed maintenance records (including asset costs, supplier information, and repair notes) by directly accessing specific record URLs. This bypasses the application's intended access controls and exposes sensitive financial and operational data.

Technologies: [snipe/snipe-it (Packagist)](https://junglewise.ai/threats/technologies/snipe-snipe-it), [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-55703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55703 being exploited in the wild.

**How severe is CVE-2026-55703?** Medium severity, with a CVSS score of 4.3, published 19 August 2026.

**Which products and versions are affected?** snipe/snipe-it (Packagist) < 8.6.3, ECOSYSTEM:introduced=0,fixed=8.6.3.

**Is there a fix for CVE-2026-55703?** Yes. snipe/snipe-it (Packagist): upgrade to 8.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55703 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55703?** Check whether you run snipe/snipe-it (Packagist) or Snipeitapp Snipe-It at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- snipe/snipe-it (Packagist): upgrade to 8.6.3 or later

  ```sh
  composer require snipe/snipe-it:^8.6.3
  ```


## Technical details

The vulnerability is a missing authorization check (CWE-862) in the MaintenancesController::show() action. The affected method renders a maintenance record view without calling authorize(), while all sibling actions (index, edit, update, destroy) correctly enforce authorization gates. The route is protected only by authentication middleware, allowing any logged-in user within the same company to access the view. The route-model binding enforces company-scope isolation, but the missing permission gate is the defect. Maintenance IDs are sequential and visible in URLs, making them trivial to enumerate. An attacker requires only an authenticated account in the target company—no special permissions needed—to read all maintenance details including costs and notes. The fix involves adding an authorize() call for asset access in the show() method. Patch available in version 8.6.3.

## Affected products

- Grokability Snipe-IT < 8.6.3

## Identifiers

- CVE-2026-55703
- GHSA-r9r3-g9fp-3q4q

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Fixed in version 8.6.3

## References

- [https://api.github.com/users/SakusenSec](https://api.github.com/users/SakusenSec)
- [https://github.com/SakusenSec](https://github.com/SakusenSec)
- [https://api.github.com/users/SakusenSec/gists%7B/gist_id%7D](https://api.github.com/users/SakusenSec/gists%7B/gist_id%7D)
- [https://api.github.com/users/SakusenSec/repos](https://api.github.com/users/SakusenSec/repos)
- [https://avatars.githubusercontent.com/u/268783706?v=4](https://avatars.githubusercontent.com/u/268783706?v=4)
- [https://api.github.com/users/SakusenSec/events%7B/privacy%7D](https://api.github.com/users/SakusenSec/events%7B/privacy%7D)

## Related threats

- [Snipe-IT stored XSS via inline XML rendering in uploaded files API](https://junglewise.ai/threats/cve-2026-63498-snipe-it-stored-xss-via-inline-xml-rendering-in-uploaded-files)
- [Snipe-IT 2FA bypass via API token flow](https://junglewise.ai/threats/cve-2026-63493-snipe-it-2fa-bypass-via-api-token-flow)
- [Snipe-IT stored XSS in custom field names](https://junglewise.ai/threats/cve-2026-62368-snipe-it-stored-xss-in-custom-field-names)
- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)