CVE-2026-55703Medium· 4.3▾ SunlitSnipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Control…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.3%
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
snipe-it < 8.6.3Upgrade past the affected range:
snipe-it 8.6.3Affected packages:
snipe/snipe-it < 8.6.3Patched in:
snipe/snipe-it 8.6.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55694Medium· 6.5Snipe-IT is an IT asset/license management system
CVE-2026-49976Medium· 6.5Snipe-IT is an IT asset/license management system
CVE-2026-50550Medium· 5.8Snipe-IT is an IT asset/license management system
CVE-2026-55483High· 8.8Snipe-IT is an IT asset/license management system
CVE-2026-86765Medium· 6.5Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint
CVE-2026-86757Medium· 6.5Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date/datetime picker elements