CVE-2026-55703

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.

• CWE-862

• https://github.com/grokability/snipe-it/commit/69c50aa2aee25f837626556b4f4f3d05ec7ace96
• https://github.com/grokability/snipe-it/releases/tag/v8.6.3
• https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q
• https://github.com/grokability/snipe-it/security/advisories/GHSA-r9r3-g9fp-3q4q

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55697pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55698pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm…8.8
• CVE-2026-55699pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Mani…6.5
• CVE-2026-5570A vulnerability was determined in Technostrobe HI-LED-WR120-…9.8
• CVE-2026-55700pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm s…7.1
• CVE-2026-55701The OpenTelemetry Collector Contrib repository contains comp…6.9
• CVE-2026-55704Discourse is an open-source discussion platform. Prior o 202…4.3
• CVE-2026-55706sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 07…8.3
• CVE-2026-55707In OpenStack Neutron before 28.0.2, the subnetpool onboardin…7.1
• CVE-2026-55708In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the …3.1
• CVE-2026-5571A vulnerability was identified in Technostrobe HI-LED-WR120-…7.5
• CVE-2026-55717In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, whe…5.9