Authorization Bypass in Snipe-IT by Grokability

CVE-2026-86763

What is CVE-2026-86763?

Snipe-IT versions from 7.0.12 to 8.6.3 contain a flaw in the Livewire importer component that allows authenticated non-superusers with import permissions to access Import records across the system. The vulnerability arises due to insufficient scope checks during data queries, enabling unauthorized users to retrieve sensitive information including filenames, file paths, and potential personal data from CSV imports. This exposure poses a risk of disclosing asset serial numbers and license keys, which is particularly concerning for organizations using Full Multiple Companies Support (FMCS), as it can lead to data crossing company boundaries. This issue was addressed in version 8.7.0 by constraining non-superuser access to only their own import data.

References