Description

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T19:17:20.813Z",
  "pubdate": "2026-08-19T19:17:20.813Z",
  "executiveSummary": "A broken access control vulnerability exists in Snipe-IT prior to version 8.6.3, specifically within the maintenance records handling functionality. The vulnerability arises because the application fails to properly enforce authorization checks within the controller responsible for rendering maintenance records. Any authenticated user with an activated account can exploit this flaw to view sensitive operational data.\nThe impact of successful exploitation includes the unauthorized disclosure of confidential IT asset management data. Disclosed fields comprise sensitive information such as asset tags, suppliers, purchase costs, internal notes, and operational dates. This exposes financial details and infrastructure metadata to lower-privileged users who lack explicit asset or maintenance permissions.\nThe affected product is Snipe-IT across versions prior to 8.6.3. The risk implication centers on horizontal privilege escalation within the context of asset tracking, where users can bypass role-based access restrictions. Attacker capabilities are constrained only by the requirement of having an activated account within the system. Exploitation requirements are minimal, needing only valid authentication and the ability to construct or issue HTTP requests to specific application endpoints.",
  "technicalDetails": "The root cause of the vulnerability lies within the application routing and controller logic of Snipe-IT. Specifically, the app/Http/Controllers/MaintenancesController.php file implements the show() method, which is responsible for rendering maintenance records. During the execution of this method, the controller fails to invoke explicit authorization checks, such as an authorize() function call, to verify whether the currently authenticated user possesses the necessary privileges to view the requested resource.\nWhile company-scoped route-model binding is utilized by the application, it only isolates records between different tenant companies. Consequently, this mechanism restricts access to other companies but implicitly trusts that any request targeting a record within the user's own company is authorized. Because individual asset and maintenance permissions are not validated at the controller level, any user belonging to the same company can access records they are not explicitly permitted to see.\nThe attack flow proceeds as follows. First, an authenticated attacker with an activated account identifies or enumerates valid identifier values for target records. Second, the attacker issues a direct HTTP request to the endpoint /maintenances/{id}, supplying the targeted maintenance record identifier. Third, the application processes the request through route-model binding, confirming only that the maintenance record belongs to the user's company. Finally, because the show() method in MaintenancesController.php lacks authorization logic, the application retrieves and renders the record details in the HTTP response.\nThe vulnerable component is the show() function located in app/Http/Controllers/MaintenancesController.php. Affected versions include all instances of Snipe-IT prior to version 8.6.3. Authentication requirements dictate that the attacker must possess an active user account within the system. Privilege requirements are minimal, as standard users with activated accounts can exploit the flaw without holding specific asset or maintenance permissions. Network exposure involves internal or external accessibility to the Snipe-IT web application interface over standard HTTP or HTTPS protocols.\nThe payload behavior is passive in terms of data exfiltration, relying on forced browsing or direct resource requests rather than code execution. The post-exploitation impact includes the aggregation of sensitive enterprise asset intelligence, purchase costs, supplier relationships, and operational notes, which could be leveraged for further reconnaissance or targeted attacks against the organization's IT infrastructure."
}