CVE-2026-86763: snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, filepath, filesize, importtype and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (headerrow column headers and firstrow, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
For Snipe-IT versions >= 7.0.12 and <= 8.6.3, restrict access to the imports.index route (App\Livewire\Importer) so non-superusers can’t invoke the Livewire importer actions that allow selecting other users’ Import records and preview data.
Event History
Frequently Asked Questions
Which users can access another user's import information?
Any authenticated non-superuser who has the import permission is affected. In Full Multiple Companies Support deployments, those users can also access import information belonging to other companies or tenants.
What information can be exposed?
An affected user can view Import record metadata, including the original filename, file path, file size, import type, and creation timestamp. They can also load stored CSV preview data: column headers and the first row of the CSV; the full CSV file is not exposed by this issue.
What is required to retrieve another user's preview data?
The user needs an authenticated account with the import permission and can invoke the selectFile action using another Import record's auto-incrementing ID. Superusers are not affected by the missing ownership or company scoping.
What can be done before upgrading?
Remove or restrict the import permission for non-superuser accounts where it is not required, since that permission is required for the exposure. Upgrade to version 8.7.0, which scopes non-superuser import reads to records owned by the caller.