CVE-2026-55703: Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

August 19, 2026

MaintenancesController::show() renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; show() does not. Any user in the asset’s company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting /maintenances/{id}, regardless of permissions.

References

github.com/advisories/GHSA-r9r3-g9fp-3q4q
github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96
github.com/grokability/snipe-it/releases/tag/v8.6.3
github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q
nvd.nist.gov/vuln/detail/CVE-2026-55703

Code Behaviors & Features

Detect and mitigate CVE-2026-55703 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →