CVE-2026-86763

Name of the Vulnerable Software and Affected Versions Snipe-IT versions 7.0.12 through 8.6.3

Description An authorization bypass exists in the Livewire importer component (AppLivewireImporter), mounted at the imports.index route. The component verifies the general import permission only during the mount phase, while the files() and activeFile() computed properties query the imports table without restricting results by owner or company. Consequently, any authenticated non-superuser with import permissions can view all import records on the instance, including original filenames, file paths, file sizes, import types, and creation timestamps. Additionally, an attacker can use the selectFile($id) Livewire action with an auto-incrementing Import ID to access another user's record, exposing preview data such as the header row and first row of the CSV. This can lead to the disclosure of sensitive information, such as personal data, asset serial numbers, and license keys, and can cross company or tenant boundaries in Full Multiple Companies Support (FMCS) deployments. The impact is limited to preview data and does not affect superusers.

Recommendations Update Snipe-IT to version 8.7.0.