THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-r9r3-g9fp-3q4q (medium) — Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

[GHSA] GHSA-r9r3-g9fp-3q4q (medium) — Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

highgithub_advisoriesPublished 2026-08-19

GHSA-r9r3-g9fp-3q4q Severity: medium CVE: CVE-2026-55703

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

### Impact Any activated account in a company can read every maintenance record for that company (asset tag, supplier, purchase cost, free-text notes, dates) without holding any asset or maintenance permission.

## Summary

`MaintenancesController::show()` renders a m

Indicators of compromise

69c50aa2aee25f837626556b4f4f3d05ec7ace96sha1
CVE-2026-55703cve

Original source: https://github.com/advisories/GHSA-r9r3-g9fp-3q4q