CVE-2026-86746

Snipe-IT before 8.7.0 contains an authorization bypass (CWE-269) in its Livewire components, which enforce permissions only at the routing layer and not within component lifecycle methods. An authenticated user can replay signed Livewire component snapshots to POST /livewire/update, invoking protected component methods that should be restricted to administrators. This allows the attacker to escalate privileges, including creating OAuth clients, minting personal access tokens, and reading sensitive admin data. All Snipe-IT deployments running a version prior to 8.7.0 are affected. No public proof-of-concept is known and the issue is not in CISA's KEV, so exploitation has not been confirmed in the wild.

What to do: Upgrade to Snipe-IT 8.7.0 or later. If upgrading is delayed, restrict or monitor access to /livewire/update and audit existing personal access tokens and OAuth clients for unauthorized entries, since exploitation requires an authenticated low-privileged session. Prioritize internet-facing instances where untrusted users hold accounts.