CVE-2026-55703

Katalog CVE

CVSS 4.3 · Medium EPSS 0,34%

Kerentanan Missing Authorization pada snipeitapp snipe-it. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q exploit · patch · advisory vendor
• https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96 patch
• https://github.com/grokability/snipe-it/releases/tag/v8.6.3 release notes · patch