CVE-2026-55703 describes a missing authorization vulnerability in Snipe-IT, an IT asset/license management system by grokability. In versions before 8.6.3, any activated account can request the endpoint /maintenances/{id} to read maintenance records for assets belonging to the same company without requiring explicit asset or maintenance permissions. The vulnerability exists because the show() method in app/Http/Controllers/MaintenancesController.php renders maintenance records without calling an authorization check, relying solely on company-scoped route-model binding to prevent access to other companies' data. This leads to unauthorized disclosure of sensitive asset maintenance details such as asset tags, suppliers, purchase costs, notes, and dates. The issue is resolved in version 8.6.3.

The vulnerability allows any activated user within the same company to access maintenance records of assets without proper authorization. This results in unauthorized disclosure of sensitive asset information including asset tags, suppliers, purchase costs, notes, and maintenance dates. There is no impact on integrity or availability reported. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low impact confidentiality loss with no integrity or availability impact.

Upgrade Snipe-IT to version 8.6.3 or later, where the missing authorization check in the maintenance record endpoint has been fixed. Prior to upgrading, restrict access to activated accounts carefully and monitor for unauthorized access. Patch status is confirmed fixed in 8.6.3.