CVE-2026-86746

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Snipe-IT via Livewire Component Replay

Publication date: 2026-09-09

Last updated on: 2026-09-14

Assigner: VulnCheck

Description

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-14

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86746

EUVD

EUVD-2026-74923

Affected Vendors & Products

Vendor	Product	Version / Range
snipeitapp	snipe-it	to 8.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in Snipe-IT versions before 8.7.0. It occurs because Livewire components only enforce authorization at the route level, not during component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges.

Detection Guidance

To detect this vulnerability, monitor POST requests to /livewire/update endpoints in Snipe-IT versions before 8.7.0. Check for repeated or unusual component snapshot replays from authenticated sessions. Review logs for unauthorized actions like OAuth client creation or token generation by non-admin users.

Impact Analysis

An attacker could create OAuth clients, generate personal access tokens, access sensitive admin data, revoke other users' tokens, or enumerate personal access tokens. The primary attack involves tricking an admin into approving an OAuth client, granting the attacker a long-lived admin API token with full permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive administrative data, including user tokens and OAuth clients, which may violate data protection requirements under GDPR and HIPAA. Unauthorized privilege escalation could result in unauthorized data exposure or modification, posing significant compliance risks.

Mitigation Strategies

Immediately upgrade Snipe-IT to version 8.7.0 or later. If upgrading is not possible, implement additional authorization checks in Livewire component lifecycle methods. Restrict access to /livewire/update endpoints and monitor for suspicious POST requests.

Hi! I’m here to help you understand CVE-2026-86746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70