Description

Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-09T14:17:26.407Z",
  "pubdate": "2026-09-09T14:17:26.407Z",
  "executiveSummary": "Snipe-IT versions 7.0.12 through 8.6.3 are susceptible to an authorization bypass vulnerability within the Livewire importer component (App\\Livewire\\Importer).\nThe vulnerability manifests as an Insecure Direct Object Reference (IDOR) and broken access control, allowing authenticated users with the 'import' permission to access import records belonging to other users or companies.\nBy manipulating the ID parameter in the selectFile($id) Livewire action, an attacker can retrieve sensitive preview data, including CSV headers and the initial data row.\nThis flaw represents a significant risk to data confidentiality, particularly in Full Multiple Companies Support (FMCS) deployments, as it allows cross-tenant data leakage.\nExploitation requires an authenticated session with the 'import' permission. No superuser privileges are required, and the attack is limited to sensitive preview metadata stored in the database rather than the full raw file content.",
  "technicalDetails": "The vulnerability resides in the App\\Livewire\\Importer component, which handles CSV imports via the imports.index route. The root cause is a deficiency in the component's authorization logic during data retrieval.\nWhile the component correctly verifies the broad 'import' permission at the mount lifecycle stage, it fails to enforce row-level access control on the underlying 'imports' database table.\nSpecifically, the files() and activeFile() computed properties perform database queries to fetch import records without applying any scopes related to the 'user_id' or 'company_id' attributes of the caller.\nBecause these queries lack tenant or owner scoping, the application treats the 'imports' table as globally accessible to any user possessing the 'import' privilege.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates as a standard user with the 'import' permission. 2) The attacker identifies that the application uses auto-incrementing integers for Import IDs. 3) The attacker invokes the selectFile($id) Livewire action, iterating through sequential ID values to query records they are not authorized to view.\nUpon successful invocation with an unauthorized ID, the backend loads the target record into the component state. This exposes sensitive metadata, including the 'header_row' and 'first_row' data fields.\nThis behavior results in unauthorized disclosure of PII, asset serial numbers, and software license keys contained within the CSV preview buffers. In deployments utilizing FMCS, this mechanism effectively bypasses logical data isolation boundaries between distinct tenants.\nThe scope of impact is restricted to the data previewed in the importer interface. The vulnerability does not grant direct access to the entire uploaded file on the filesystem unless further side-channel vulnerabilities exist. However, the leakage of header and first-row data is frequently sufficient to compromise enterprise secrets."
}