An authorization bypass exists in the Livewire importer component of Snipe‑IT. The component checks only a broad “import” ability during mounting, while the files() and activeFile() properties query the imports table without owner or company filtering. Consequently, any authenticated non‑superuser with import permission can view all Import records, including filenames, file paths, sizes, types, timestamps, headers, and the first data row of the uploaded CSV. The data that can be exposed often contains personal information, asset serial numbers, and license keys. In Full Multiple Companies Support deployments the vulnerability also allows cross‑company disclosure, although superusers remain unaffected.

This vulnerability affects all Snipe‑IT releases from version 7.0.12 up to and including 8.6.3. The affected product is the Snipe‑IT asset management application, hosted on web servers running the application. The issue was addressed in version 8.7.0, which scopes import reads to the record owner.

The CVSS score is 5.1, indicating a moderate severity flaw. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user with the general import permission; it can be performed through the imports.index route by calling the selectFile($id) action to view any import record belonging to another user. Superusers are not affected because the vulnerability is limited to non‑superuser reads. While the attacker cannot retrieve the full CSV file or execute code, the preview data may contain highly sensitive personal or contractual information, and in multi‑tenant deployments the risk of cross‑company data exposure is significant.