CVE-2026-86754

Undergoing Analysis Undergoing Analysis - In Progress

Snipe-IT OAuth Client Registration Bypass Leads to Privilege Escalation

Publication date: 2026-09-09

Last updated on: 2026-09-20

Assigner: VulnCheck

Description

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-20

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86754

EUVD

EUVD-2026-74931

Affected Vendors & Products

Vendor	Product	Version / Range
snipe-it	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	to 8.7.0 (exc)
grokability	snipe-it	8.6.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Snipe-IT before version 8.7.0 has a flaw where any authenticated user can register OAuth clients with attacker-controlled redirect URIs due to improper access control in Laravel Passport's routes. Attackers trick admins into approving consent screens, then exchange authorization codes for admin-level API tokens valid for up to 40 years.

Detection Guidance

Check Snipe-IT version with 'composer show snipe/snipe-it' or 'php artisan snipeit:version'. Inspect network traffic for unauthorized OAuth client registrations at '/oauth/clients' endpoints. Review admin logs for unexpected token generation requests to '/oauth/token'.

Impact Analysis

An attacker could gain full admin API permissions, allowing unauthorized access to sensitive data, user management, and system modifications. The long token validity (40 years) means prolonged exposure if not revoked. Requires a valid session and social engineering to trick an admin.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include fines, legal action, and reputational damage.

Mitigation Strategies

Upgrade Snipe-IT to version 8.7.0 or later immediately. Review and revoke any suspicious OAuth tokens in the admin panel. Implement network monitoring for '/oauth/clients' and '/oauth/token' endpoints to detect exploitation attempts.

Hi! I’m here to help you understand CVE-2026-86754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70