CVE-2026-55703

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Impact

Any activated account in a company can read every maintenance record for that company (asset tag, supplier, purchase cost, free-text notes, dates) without holding any asset or maintenance permission.

Summary

MaintenancesController::show() renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; show() does not. Any user in the asset's company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting /maintenances/{id}, regardless of permissions.

Details

public function show(Maintenance $maintenance): View|RedirectResponse
{
    return view('maintenances.view')->with('maintenance', $maintenance);
}

No authorize() call. The sibling actions all gate on the asset: index() calls authorize('view', Asset::class) (line 33), and edit()/update()/destroy() call authorize('update', $maintenance->asset) (lines 139, 166, 286). The route is registered with only the auth guard:

Route::resource('maintenances', MaintenancesController::class, ['middleware' => ['auth']]);

(routes/web/hardware.php:185). Route-model binding still applies the company scope, so the read is bounded to the caller's company; the absent permission gate is the defect. Maintenance IDs are sequential and visible in the record URL.

Proof of concept

1. As an administrator, create an asset in a company (here, CompanyA). Open the asset, choose Maintenances > Create, and add a record: name MntA2, supplier SupA, a purchase cost, and notes. The saved record opens at /maintenances/{id}.
2. As the administrator, create a test user assigned to CompanyA, with every permission left unchecked. Activate the account.
3. In a separate browser session, log in as the test user. Confirm it is unprivileged: the Assets and Maintenances navigation items are absent, and browsing to /hardware returns 403.
4. In the address bar, browse to http://<host>/maintenances/{id}.

Observed: the maintenance view renders in full for the unprivileged account.

GET /maintenances/5      ->  HTTP 200 OK
Renders the "Maintenance" detail page for MntA2:
  Asset: AssetA   Supplier: SupA   Cost: <value>   Notes: <text>   Dates: <...>

GET /hardware            ->  HTTP 403  (same account, asset list is gated)
GET /maintenances        ->  HTTP 403  (same account, maintenance list is gated)
GET /maintenances/2      ->  HTTP 302  (record in CompanyB; company scope still hides it)

• The test account holds zero permissions and still reads the record.
• Only the unguarded show route leaks: the list view and the asset pages return 403 for the same account.
• A maintenance in a different company (CompanyB) redirects away, confirming the FMCS company scope still holds.

Patches

Patched in https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Impact

Any activated account in a company can read every maintenance record for that company (asset tag, supplier, purchase cost, free-text notes, dates) without holding any asset or maintenance permission.

Summary

MaintenancesController::show() renders a maintenance record without any authorization check. Every other action in the controller authorizes against the asset; show() does not. Any user in the asset's company can read maintenance detail (asset tag, supplier, purchase cost, notes, dates) by visiting /maintenances/{id}, regardless of permissions.

Details

public function show(Maintenance $maintenance): View|RedirectResponse
{
    return view('maintenances.view')->with('maintenance', $maintenance);
}

No authorize() call. The sibling actions all gate on the asset: index() calls authorize('view', Asset::class) (line 33), and edit()/update()/destroy() call authorize('update', $maintenance->asset) (lines 139, 166, 286). The route is registered with only the auth guard:

Route::resource('maintenances', MaintenancesController::class, ['middleware' => ['auth']]);

(routes/web/hardware.php:185). Route-model binding still applies the company scope, so the read is bounded to the caller's company; the absent permission gate is the defect. Maintenance IDs are sequential and visible in the record URL.

Proof of concept

1. As an administrator, create an asset in a company (here, CompanyA). Open the asset, choose Maintenances > Create, and add a record: name MntA2, supplier SupA, a purchase cost, and notes. The saved record opens at /maintenances/{id}.
2. As the administrator, create a test user assigned to CompanyA, with every permission left unchecked. Activate the account.
3. In a separate browser session, log in as the test user. Confirm it is unprivileged: the Assets and Maintenances navigation items are absent, and browsing to /hardware returns 403.
4. In the address bar, browse to http://<host>/maintenances/{id}.

Observed: the maintenance view renders in full for the unprivileged account.

GET /maintenances/5      ->  HTTP 200 OK
Renders the "Maintenance" detail page for MntA2:
  Asset: AssetA   Supplier: SupA   Cost: <value>   Notes: <text>   Dates: <...>

GET /hardware            ->  HTTP 403  (same account, asset list is gated)
GET /maintenances        ->  HTTP 403  (same account, maintenance list is gated)
GET /maintenances/2      ->  HTTP 302  (record in CompanyB; company scope still hides it)

• The test account holds zero permissions and still reads the record.
• Only the unguarded show route leaks: the list view and the asset pages return 403 for the same account.
• A maintenance in a different company (CompanyB) redirects away, confirming the FMCS company scope still holds.

Patches

Patched in https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96