---
id: CVE-2026-86763
title: >-
  Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in
  the Livewire importer component (App\Livewire\Importer, mounted at the
  imports.index route)
summary: >-
  Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in
  the Livewire importer component (App\Livewire\Importer, mounted at the
  imports.index route). The component only checked the broad 'import' ability at
  mount time,…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: snipeitapp
product: snipe-it
affected:
  - 'snipe-it >= 7.0.12, < 8.7.0'
patched:
  - snipe-it 8.7.0
published: '2026-09-09'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:27:08.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86763'
references:
  - url: >-
      https://github.com/grokability/snipe-it/security/advisories/GHSA-89q3-jmfm-hvcm
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snipe-it-7.0.12-through-8.6.3-authorization-bypass-via-importer
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00272
epssPercentile: 0.17424
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T14:30:07.882516Z'
ingestedAt: '2026-09-13T21:23:30.726Z'
---

## Overview

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.

## Affected

- `snipe-it >= 7.0.12, < 8.7.0`

## Remediation

Upgrade past the affected range:

- `snipe-it 8.7.0`