Listen to this Post
Snipe-IT is an open-source IT asset and license management system. Prior to version 8.6.3, the application contained a missing authorization vulnerability in the `MaintenancesController::show()` method. This controller method is responsible for rendering a maintenance record detail page when a user navigates to /maintenances/{id}.
The core of the issue lies in the absence of an `authorize()` call within the `show()` function. In contrast, every other action in the same controller—such as index(), edit(), update(), and destroy()—properly gates access against the associated asset. For example, the `edit()` and `update()` methods call `authorize(‘update’, $maintenance->asset)` to ensure the user has permission to modify the asset linked to the maintenance record. The `show()` method, however, simply returns the view with the maintenance model:
public function show(Maintenance $maintenance): View|RedirectResponse
{
return view('maintenances.view')->with('maintenance', $maintenance);
}
This vulnerability is compounded by the route registration. The `/maintenances` resource route is registered with only the `auth` middleware, which merely ensures a user is logged in:
Route::resource('maintenances', MaintenancesController::class, ['middleware' => ['auth']]);
It does not enforce any additional permission checks. While the framework’s route-model binding does apply a company scope—meaning a user in Company A cannot view a maintenance record belonging to Company B—it does not prevent a user within the same company from viewing all maintenance records, regardless of their specific asset or maintenance permissions.
Maintenance IDs are sequential and visible in the URL, making them easily enumerable. An attacker with a valid account in a company can thus systematically access all maintenance records for that company by guessing or iterating through IDs. The disclosed information includes sensitive fields such as the asset tag, supplier, purchase cost, free-text notes, and dates.
The vulnerability was patched in commit `grokability/snipe-it@69c50aa` and fixed in version 8.6.3. It has been assigned CVE-2026-55703 with a CVSS v3.1 base score of 4.3 (Medium severity).
DailyCVE Form:
Platform: Snipe-IT
Version: <8.6.3
Vulnerability: Missing Authorization
Severity: Medium (4.3)
date: 2026-08-19
Prediction: 2026-08-19
What Undercode Say:
The vulnerability exists because the `MaintenancesController::show()` method lacks an authorization check, unlike its sibling methods.
– Affected endpoint: `GET /maintenances/{id}`
– Root cause: Missing `authorize()` call in `app/Http/Controllers/MaintenancesController.php`
– Patch: Added `$this->authorize(‘view’, $maintenance);` or similar authorization logic to the `show()` method.
Exploit: (Educational Purposes!)
1. Identify a target Snipe-IT instance.
- Obtain valid credentials for any activated account within a company.
- Log in and navigate to a maintenance record URL, e.g., `https://target.example.com/maintenances/1`.
4. Observe the full maintenance details are displayed.
- Iterate the numeric ID in the URL to access other records (e.g.,
/maintenances/2,/maintenances/3, etc.).Example bash loop to enumerate maintenance records for i in {1..100}; do curl -s -o /dev/null -w "%{http_code}\n" -b "session_cookie=value" "https://target.example.com/maintenances/$i" done
Protection:
- Upgrade: Immediately upgrade Snipe-IT to version 8.6.3 or later.
- Access Control: Ensure that all controller methods handling sensitive data include proper authorization checks using Laravel’s authorization gates or policies.
- Input Validation: While not a direct mitigation for this flaw, implementing additional logging and monitoring for unusual access patterns to `/maintenances/` endpoints can help detect exploitation attempts.
Impact:
An attacker with any activated account in a company can read all maintenance records for that company without holding any asset or maintenance permission. The exposed information includes asset tags, supplier names, purchase costs, free-text notes, and dates. This constitutes a significant breach of confidentiality, as sensitive procurement and asset management data is disclosed to unauthorized users within the same organizational scope.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
