CVE-2026-86746 in Snipe-IT
Summary
by MITRE • 09/09/2026
Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical authorization bypass within the application's Livewire component architecture. This flaw stems from an inconsistent implementation of security controls where authentication checks are enforced exclusively at the HTTP route level rather than being validated within the individual lifecycle methods of the Livewire components themselves. In modern web frameworks that utilize server-driven UI updates like Livewire, it is imperative for developers to ensure that every discrete action or method invocation triggers a fresh authorization check against the current user's permissions and role assignments. By relying solely on route-level middleware, the application fails to verify whether the authenticated session possesses the specific privileges required to execute sensitive operations exposed through these components. This architectural oversight creates a significant gap in access control logic, allowing attackers who have obtained valid credentials or hijacked an active session to bypass intended restrictions.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and data exfiltration. An attacker can exploit the flaw by crafting malicious requests that replay signed component snapshots via the POST /livewire/update endpoint. This mechanism allows the invocation of protected methods that are not meant to be accessible to lower-privileged users or unauthenticated entities if proper checks were in place. Through this exploitation path, an adversary can perform high-risk administrative actions such as creating new OAuth clients and minting personal access tokens. The creation of unauthorized OAuth clients provides a persistent foothold within the application's authentication ecosystem, while the generation of personal access tokens grants long-lived API credentials that do not require interactive login sessions, thereby facilitating sustained unauthorized access even if the initial session is terminated or detected.
Furthermore, this vulnerability enables direct access to sensitive administrative data and configuration settings that are typically restricted to system administrators. The ability to mint tokens and create clients effectively elevates a standard user's capabilities to those of an administrator, compromising the integrity, confidentiality, and availability of the IT asset management platform. This aligns with CWE-284 Improper Access Control, specifically highlighting failures in enforcing authorization constraints on specific actions or methods rather than just entry points. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1556 Modifying Authentication Process if the attacker leverages the created OAuth clients for further lateral movement or persistence within an enterprise environment. The exploitation does not require complex injection techniques but rather a precise manipulation of the application's state management protocol, making it relatively straightforward to automate against vulnerable instances.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to upgrade Snipe-IT to version 8.7.0 or later, where this authorization logic has been corrected to enforce checks within the component lifecycle methods. For environments that cannot immediately patch due to compatibility constraints, administrators should implement strict network-level controls such as Web Application Firewalls (WAF) rules that monitor and restrict unusual patterns of POST requests to the /livewire/update endpoint, particularly those involving known sensitive method signatures. Additionally, enforcing multi-factor authentication for all administrative accounts reduces the risk associated with credential theft or session hijacking, which is often a prerequisite for exploiting this specific flaw. Regular security audits should also review Livewire component implementations across the codebase to ensure that authorization checks are consistently applied at both the route and method levels, adhering to the principle of least privilege throughout all application layers.