CVE-2026-86763 snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer

What is CVE-2026-86763?

CVE-2026-86763 is a medium-severity missing authorization vulnerability in Snipeitapp Snipe-It, published on 9 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.

Weakness: CWE-639

Which versions are affected by CVE-2026-86763?

It affects 1 product.

Products include Snipeitapp Snipe-It.

How do I fix CVE-2026-86763?

No fix has been published for CVE-2026-86763 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-86763 being exploited?

There is no known exploitation of CVE-2026-86763 in the wild and no public exploit code.

Other vulnerabilities in Snipeitapp Snipe-It

• CVE-2025-63601 File upload in n/a Critical 9.9
• CVE-2026-37709 Snipe-IT has insecure permissions in file uploads Critical 9.8
• CVE-2026-86738 Snipe-IT before 8.7.0 CSS Injection via Custom CSS Critical 9.3
• CVE-2026-116199 Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback Critical 9.2
• CVE-2022-1380 Stored Cross Site Scripting vulnerability in Item name parameter in snipe/snipe-it Critical 9.1

All Snipeitapp Snipe-It vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-89q3-jmfm-hvcm, GHSA-f6pr-q64w-m977.