CVE-2026-86763: Snipe-IT Authorization Bypass Vulnerability

CVE-2026-86763 Overview

CVE-2026-86763 is an authorization bypass in the Snipe-IT asset management platform affecting versions >= 7.0.12 and <= 8.6.3. The flaw resides in the Livewire importer component (App\Livewire\Importer) mounted at the imports.index route. The component checks the broad import ability at mount time but fails to scope subsequent queries to the owning user or company. Any authenticated non-superuser with the import permission can enumerate every Import record on the instance and load preview data from imports created by other users. In Full Multiple Companies Support (FMCS) deployments, the disclosure crosses tenant boundaries. This maps to [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated users with import permission can read filenames, file paths, upload metadata, and CSV preview rows (headers plus first data row) from other users' and other companies' imports, exposing personal data, asset serial numbers, and license keys.

Affected Products

Snipe-IT versions >= 7.0.12
Snipe-IT versions <= 8.6.3
Snipe-IT deployments using Full Multiple Companies Support (FMCS)

Discovery Timeline

2026-09-09 - CVE-2026-86763 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86763

Vulnerability Analysis

The Livewire importer component enforces authorization only at mount time using a broad import ability check. Once mounted, the component exposes two computed properties, files() and activeFile(), that query the imports table without applying an owner or company scope. A user holding the import permission can therefore observe every Import row on the instance.

Each exposed record contains the original filename, file_path, filesize, import_type, and creation timestamp. The component also exposes a selectFile($id) Livewire action that accepts an arbitrary auto-incrementing Import ID. Invoking this action loads another user's record and returns its stored preview data, including the header_row column headers and the first_row values from the CSV.

Impact is bounded to preview data rather than the complete CSV file, and superuser-owned imports remain protected from this scoping error. However, Snipe-IT import CSVs routinely carry employee personal data, asset serial numbers, and software license keys. In FMCS multi-tenant deployments, the missing company scope allows cross-tenant disclosure of these fields.

Root Cause

The root cause is a missing authorization check on individual records. The files() and activeFile() computed properties trust the initial ability check and do not filter results by the authenticated user's id or company_id. This is a textbook Insecure Direct Object Reference pattern.

Attack Vector

An authenticated attacker holding the import permission navigates to the imports.index route. The rendered Livewire component enumerates all Import records visible to the query. The attacker then triggers the selectFile($id) action with any valid auto-incrementing Import ID to retrieve preview data belonging to another user or company. No user interaction from the victim is required beyond having previously uploaded an import.

See the GitHub Security Advisory GHSA-89q3-jmfm-hvcm and the VulnCheck Snipe-IT Advisory for the maintainer analysis.

Detection Methods for CVE-2026-86763

Indicators of Compromise

Repeated Livewire requests to the imports.index route from a single authenticated non-superuser session enumerating sequential Import IDs.
selectFile Livewire action calls referencing Import IDs that were not created by the calling user.
Application logs showing preview data reads for imports owned by other user_id or company_id values.

Detection Strategies

Correlate web server access logs with the Snipe-IT users table to flag selectFile calls where the parameter maps to an Import.user_id different from the session user.
Add application-level logging on the files() and activeFile() computed properties to record record owner versus requester identity.
In FMCS deployments, alert on any importer read that returns rows spanning multiple company_id values within a single session.

Monitoring Recommendations

Baseline typical import activity per user and flag sessions that access an unusually high number of Import records in a short window.
Ship Snipe-IT web and application logs to a centralized log platform and retain them for post-incident analysis.
Review audit trails for accounts holding the import permission and confirm the permission is only granted where required.

How to Mitigate CVE-2026-86763

Immediate Actions Required

Upgrade Snipe-IT to version 8.7.0 or later, which scopes non-superuser reads to imports owned by the caller.
Audit accounts with the import permission and revoke it for users who do not need import functionality.
Rotate any credentials, license keys, or secrets that may have been present in preview rows of previously uploaded import CSVs.

Patch Information

The vulnerability is fixed in Snipe-IT version 8.7.0. The patch modifies the App\Livewire\Importer component so that non-superuser queries against the imports table apply an owner scope, restricting files(), activeFile(), and selectFile($id) to records owned by the authenticated user. Superuser behavior is unchanged. Refer to the GitHub Security Advisory GHSA-89q3-jmfm-hvcm for the official fix commit.

Workarounds

Temporarily restrict the import permission to trusted administrators until the upgrade to 8.7.0 is complete.
Avoid uploading CSVs containing plaintext secrets, license keys, or regulated personal data until the fixed version is deployed.
In FMCS environments, disable end-user access to the importer route at the reverse proxy or web application firewall layer.

bash

# Configuration example
# Verify the running Snipe-IT version before and after upgrade
php artisan --version
grep "'version'" config/version.php

# Upgrade to the fixed release
git fetch --tags
git checkout v8.7.0
composer install --no-dev --prefer-source
php artisan migrate --force
php artisan config:clear && php artisan cache:clear