CVE-2026-86746: Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay
Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to invoke protected methods and escalate privileges, including creating OAuth clients, minting personal access tokens, and accessing sensitive admin data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snipe-ITto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Since Snipe-IT before 8.7.0 is vulnerable to Livewire snapshot replay against POST /livewire/update, restrict access to POST /livewire/update (and the Livewire update endpoint) to trusted users and/or network locations until the upgrade to 8.7.0 is completed.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid authenticated Snipe-IT session. The vector is network-accessible, but exploitation also requires user interaction and has high attack complexity.
Which deployments are affected?
Snipe-IT versions before 8.7.0 are affected. The available information does not identify any configuration prerequisite or state that a default deployment is exempt.
What actions could a successful attacker perform?
A successful replay of signed Livewire component snapshots can invoke protected methods. Documented impacts include privilege escalation, creating OAuth clients, minting personal access tokens, and accessing sensitive administrative data.
How can this be mitigated if an upgrade cannot be performed immediately?
No interim mitigation is provided in the available data. Because exploitation requires an authenticated session, limiting access to trusted authenticated users may reduce exposure, but this is not stated as a complete fix.