A missing authorization guard in Snipe‑IT’s maintenance record endpoint allows any activated user to retrieve detailed information about assets within the same company by issuing a simple GET request to /maintenances/{id}. The flaw exposes sensitive fields such as asset tags, suppliers, purchase costs, notes, and dates, thereby compromising confidentiality and potentially aiding attackers or insiders. This weakness is a classic missing authorization failure (CWE‑862) and has a CVSS score of 4.3.

The vulnerability targets the Snipe‑IT asset management system developed by grokability. The exact list of affected versions is not explicitly enumerated in the CNA data; however, the advisory notes that all releases prior to 8.6.3 are vulnerable until the fix is applied in 8.6.3, which should be deployed to mitigate the risk.

The exploitation requires only an authenticated account within the same company; no elevated privileges or special configuration are needed. Attackers can simply issue a GET request to the specific maintenance record URL. The CVSS score of 4.3 indicates a medium severity, and the EPSS score is unavailable, so the current exploitation probability cannot be precisely quantified. The vulnerability is not listed in the CISA KEV catalog. Given that any activated user can exploit the flaw, the confidentiality of asset information is significantly exposed in environments where sensitive details are stored.