Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the show process of the MaintenancesController. An attacker can access sensitive maintenance records belonging to their company by directly browsing...

PT-2026-80308

Impact Any activated account in a company can read every maintenance record for that company asset tag, supplier, purchase cost, free-text notes, dates without holding any asset or maintenance permission. Summary MaintenancesController::show renders a maintenance record without any authorization...