Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-55703

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 26.5%
CVSS Severity
CVSS v3 Score 4.3
Products affected by CVE-2026-55703


Contact Us

Shodan ® - All rights reserved