Executive brief
Snipe-IT is an IT asset management platform used by organizations to track hardware, software, and licenses. The vulnerability allows authenticated users to bypass authorization checks in Livewire components by replaying signed snapshots, enabling privilege escalation to admin-level access. An attacker could create unauthorized OAuth tokens with 40-year expiration, mint personal access tokens, or access sensitive admin data without proper authorization.
Technical details
The vulnerability is an authorization bypass (CWE-863) in multiple Livewire components in app/Livewire/ that enforce authorization only at the route-level middleware, not within component lifecycle methods. Livewire's POST /livewire/update endpoint accepts any valid signed component snapshot and executes requested public methods under the current session's user context, bypassing route-level middleware entirely. A low-privilege authenticated attacker can replay protected component snapshots (obtained from shared pages, HAR files, or previous sessions) to invoke admin-only methods like OauthClients::createClient, OauthClients::editClient, PersonalAccessTokens::createToken, and others. The primary attack chain requires an admin to authorize an attacker-created OAuth client via social engineering, resulting in a long-lived admin-scoped bearer token. Secondary attacks (token revocation, PAT enumeration) require no user interaction. Versions <= 8.6.3 are affected; patches are available in 8.7.0 and later.
Affected products
- Snipe-IT Snipe-IT before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory (GHSA-jchx-hfqg-rm2m) published
- 2026-09-09: advisory: CVE-2026-86746 published