CVE-2026-55703: Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

August 19, 2026

MaintenancesController::show() renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; show() does not. Any user in the asset’s company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting /maintenances/{id}, regardless of permissions.

References

github.com/advisories/GHSA-r9r3-g9fp-3q4q
github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96
github.com/grokability/snipe-it/releases/tag/v8.6.3
github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q
nvd.nist.gov/vuln/detail/CVE-2026-55703

Code Behaviors & Features

Detect and mitigate CVE-2026-55703 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →