CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.6.3 are vulnerable, allowing any activated user to access maintenance records for assets within their company without proper permissions. This exposure can lead to unauthorized disclosure of sensitive information, including asset tags, suppliers, and purchase costs. Organizations using Snipe-IT should prioritize upgrading to version 8.6.3 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.