CVE-2026-86754

Snipe-IT before 8.7.0 contains an incorrect authorization flaw (CWE-863) in which Laravel Passport's OAuth client management routes are not gated by administrative privileges, so any authenticated user can register OAuth clients with attacker-controlled redirect URIs. An attacker with a low-privilege account creates such a client and tricks an administrator into approving the OAuth consent screen, then exchanges the resulting authorization code for a bearer token. Those bearer tokens inherit the full admin API permission set and can remain valid for up to 40 years, giving the attacker persistent admin-level API access to the asset management system. All Snipe-IT deployments running a version older than 8.7.0 are affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; the flaw carries a CVSS 4.0 score of 8.5 (High), with low privileges and user interaction required.

What to do: Upgrade to Snipe-IT 8.7.0 or later. Until patched, restrict access to the OAuth client management endpoints to administrators and audit existing OAuth clients and issued bearer tokens for anything unexpected. Caution administrators against approving unfamiliar OAuth consent prompts, since a single approval can hand an attacker a full-admin API token that lasts for decades.