EUVD-2026-62627
GHSA-r9r3-g9fp-3q4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Authenticated session required (PR:L); read-only intra-company metadata disclosure only (C:L, I:N, A:N); endpoint is network-accessible by default (AV:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets in the same company without asset or maintenance permission. app/Http/Controllers/MaintenancesController.php show() renders the record without authorize(), while company-scoped route-model binding only prevents access to other companies. Disclosed fields include asset tags, suppliers, purchase costs, notes, and dates. This issue is fixed in version 8.6.3.
AnalysisAI
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing authorize() call in MaintenancesController.php show(), which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Technical ContextAI
Snipe-IT is a PHP/Laravel-based IT asset and license management application (CPE: cpe:2.3:a:grokability:snipe-it). The flaw is a textbook CWE-862 (Missing Authorization): Laravel's route-model binding was correctly scoped to prevent cross-company access, but the show() action in app/Http/Controllers/MaintenancesController.php omitted the required $this->authorize('view', $maintenance->asset) gate before rendering maintenance record details. Authorization infrastructure was present and used elsewhere in the controller - the omission was isolated to the show endpoint. The commit diff (69c50aa2) confirms the fix is a single authorize() insertion, with regression tests added for both no-permission same-company and cross-company (MFCS-enabled) scenarios.
RemediationAI
Upgrade Snipe-IT to version 8.6.3 or later, which is the vendor-confirmed fix introducing the missing $this->authorize('view', $maintenance->asset) call in the show() method of app/Http/Controllers/MaintenancesController.php. The patched release is available at https://github.com/grokability/snipe-it/releases/tag/v8.6.3. If immediate upgrade is not feasible, restrict network access to the Snipe-IT instance to trusted internal networks or VPN users only, reducing the exploitable population to already-credentialed staff - note this does not eliminate the flaw and insider threat scenarios remain unmitigated. Additionally, auditing and minimizing the number of active accounts without legitimate asset view requirements reduces exposure. Neither workaround fully remediates the vulnerability; upgrading to v8.6.3 is the only complete fix.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today