Description

It was found that if a user is not having access to supplier module, he can access and view the supplier content.

Proof of Concept

1. Create two users, one admin and one normal user
2. A normal user is not having access to the supplier module.
3. But by enumeration the normal user view the restricted content of supplier by enumeration.

POC

https://demo.snipeitapp.com/suppliers/1
Just enumerate the number, and you will see the details

Impact

This vulnerability will help an attacker view restricted content.