Snipe‑IT allows an authenticated user to update a maintenance record through the API endpoint PATCH or PUT /api/v1/maintenances/{maintenance_id}. The update routine checks authorization against the existing maintenance record and its current asset, but it does not re‑authorize the asset_id field supplied in the request. Consequently, an attacker can assign the maintenance record to an asset belonging to a different company, thereby moving the maintenance task outside the user’s authorized scope. The flaw is an improper authorization failure (CWE‑639) and compromises the integrity of maintenance data and can expose sensitive information to unauthorized parties.

Snipe‑IT in all releases prior to version 8.6.2. Any account with API write permissions to maintenance records can exploit the flaw. The issue exists only in the application logic; no specific operating system or external infrastructure is mentioned.

The CVSS score of 7.7 represents a medium‑to‑high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the Snipe‑IT API with permission to modify maintenance records, making the attack vector restricted to users with those privileges. The risk is therefore moderate, but the impact on data integrity and potential cross‑company information leakage remains significant until the application is updated to 8.6.2.